Resubmissions
16/05/2025, 05:10
250516-ftr74ahn8s1016/06/2023, 08:15
230616-j5y2kadh53914/06/2023, 14:14
230614-rjzd7shh999Analysis
- max time kernel
138s - max time network
153s - platform
android-11_x64 - resource
android-x64-arm64-20240910-en - resource tags
- submitted
16/05/2025, 05:10
General
- Target EBA (1).apk
- Size 2.3MB
- Sample250516-ftr74ahn8s
- SHA256 7a65b831c9f781e49c47393345bbe2ffff6859a608b9a5413d7f3b76683ff178
Malware Config
Extracted
-
alienbot
-
http://ensacmainsanbuinsan00.com
Signatures
- Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
- Alienbot family
- Cerberus
An Android banker that is being rented to actors beginning in 2019.
- Cerberus family
- Cerberus payload 1 IoCs
- Removes its main activity from the application launcher 1 TTPs 3 IoCs
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
- Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
- Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
- Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
bamboo.orbit.notable1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
xGJaBWr.json.cur.prof
xGJaBWr.json
xGJaBWr.json