Analysis
-
max time kernel
146s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
27/03/2025, 20:43
General
-
Target
25f8c85774f2c0cfb7122f2a1de2301498c70c239a42d0cd9399c904c22a35b9.apk
-
Size
1.4MB
-
MD5
7557a88cf8e930d33675a1cf2a3ca0f0
-
SHA1
dff8dd372f1d3137bb41820f89b67acecb7204c1
-
SHA256
25f8c85774f2c0cfb7122f2a1de2301498c70c239a42d0cd9399c904c22a35b9
-
SHA512
3d8214805293c47ed91b40653619396d1a82a9310a27c7979723a0f3b5d7d67c198802f534ba98ac882d5090c9913b7e930335edf13a7a4a658c8cdb9d4feed8
-
SSDEEP
24576:1p9ZisGtk5hudq5nS6uVA16rhWSEsKfTiVRGp4v97dxyDheGvYwWb7owcGgEKC9k:1pfJ3HYFlWF3fTiVRC4v95x8heLRozPP
Malware Config
Extracted
alienbot
http://alskdalksdlaksdjlaigpopoinojasg.info/
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
ntmserpfdosfwguutcejnye.zohzrycfeqcfuuuxjdtztl.uhph1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
324B
MD57f187bffa1ff2b6bab675e7172bd5506
SHA1f9460439f3f961d82d9057afb62361663b135567
SHA256d7d62a5a3c6b429e13b9552b0174756fabc01a1fe7f05417fd5bf520ee84b662
SHA5124991df96cb7711bf4c3b6cf84019e46a65463d2719a7a1f36aca80109da4a59b1f610951b618ba4f497537b2d0335b7c84273af805e60826b8145d95c21e5fed
-
Filesize
730KB
MD5f57737c363419720b82c569be6a9cb04
SHA138816a25583a52ca3f5eb305acdd91be887376e3
SHA2569f24e342bf3cc2b35e7fef63d682515a01193789acffe79ac74a62fb6e41d298
SHA51273370947343d3331d14c0e5c2b061db982a66c5ff556e2a5d2f3ca02e63b5f913191c7983f83b0fa43c0669ff1ae6fb59ae17db6a0af59a41efdc8a97f59bf23
-
Filesize
730KB
MD5bea1a26accb85be002f29ca8bed94444
SHA1a27216ece47a8cc87c99855e40b3dbb0bfd659b5
SHA2564f8b45eb438098549b76367305f5701ef53d467647d3479431771f1f767fb61b
SHA512567770506afeba0ed5301e86983e94c627f752c1300ef60459ec11e8d652ebb51a8a008ee4e12a872f6adafd5b29cba1abf28780a76b28bbeefc3a668f8e1fcb