Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
27/03/2025, 20:43
General
-
Target
25f8c85774f2c0cfb7122f2a1de2301498c70c239a42d0cd9399c904c22a35b9.apk
-
Size
1.4MB
-
MD5
7557a88cf8e930d33675a1cf2a3ca0f0
-
SHA1
dff8dd372f1d3137bb41820f89b67acecb7204c1
-
SHA256
25f8c85774f2c0cfb7122f2a1de2301498c70c239a42d0cd9399c904c22a35b9
-
SHA512
3d8214805293c47ed91b40653619396d1a82a9310a27c7979723a0f3b5d7d67c198802f534ba98ac882d5090c9913b7e930335edf13a7a4a658c8cdb9d4feed8
-
SSDEEP
24576:1p9ZisGtk5hudq5nS6uVA16rhWSEsKfTiVRGp4v97dxyDheGvYwWb7owcGgEKC9k:1pfJ3HYFlWF3fTiVRC4v95x8heLRozPP
Malware Config
Extracted
alienbot
http://alskdalksdlaksdjlaigpopoinojasg.info/
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 7 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
ntmserpfdosfwguutcejnye.zohzrycfeqcfuuuxjdtztl.uhph1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Performs UI accessibility actions on behalf of the user
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
394B
MD5a584a6818253467121c69a4084ab0356
SHA109a9f117fc26f1e77a4cce62ad7e0ac8c0e29d58
SHA256950c115c9152c94b3a984652fdc5b9993bd0097989a5aec6ea6ebfa45a241896
SHA5126f553d63f3c326590958abb347416d6da8f0fe0ab2346f8136ef6b07f6549621f4a74324124928701090ed4873420e0a5a74abd1ae03fe16e690e28dc1432818
-
Filesize
730KB
MD5f57737c363419720b82c569be6a9cb04
SHA138816a25583a52ca3f5eb305acdd91be887376e3
SHA2569f24e342bf3cc2b35e7fef63d682515a01193789acffe79ac74a62fb6e41d298
SHA51273370947343d3331d14c0e5c2b061db982a66c5ff556e2a5d2f3ca02e63b5f913191c7983f83b0fa43c0669ff1ae6fb59ae17db6a0af59a41efdc8a97f59bf23
-
Filesize
730KB
MD5bea1a26accb85be002f29ca8bed94444
SHA1a27216ece47a8cc87c99855e40b3dbb0bfd659b5
SHA2564f8b45eb438098549b76367305f5701ef53d467647d3479431771f1f767fb61b
SHA512567770506afeba0ed5301e86983e94c627f752c1300ef60459ec11e8d652ebb51a8a008ee4e12a872f6adafd5b29cba1abf28780a76b28bbeefc3a668f8e1fcb