alienbot | c38df11d0c7ec8b8d661855096f4f2f7ff304a3eb4cdbcdf01cb4d310b290eed

General

Target

Chrome3.17.4.apk
Size

3.0MB
MD5

2c9618687be75daa7ee99b6ceb9f3fee
SHA1

59a67ffaaf72910c50aa07ae6022fb58444f0ac6
SHA256

c38df11d0c7ec8b8d661855096f4f2f7ff304a3eb4cdbcdf01cb4d310b290eed
SHA512

71480769bcd79e094b0e9334c708f5d88f3d39372693b77bd97192f8098e34041690c105de130a45698e2ee85d3d8ff0ba545bcb7f88693670b80780fd8b7a5c

Score

10^/10

alienbot banker infostealer obfuscation stealth trojan

Malware Config

Extracted

Family

alienbot

C2

http://suffoopp.ga

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

train.stumble.easily

pid process

4230 train.stumble.easily

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

train.stumble.easily

ioc	pid	process
/data/user/0/train.stumble.easily/app_DynamicOptDex/mlxOMBx.json	4230	train.stumble.easily
/data/user/0/train.stumble.easily/app_DynamicOptDex/mlxOMBx.json	4230	train.stumble.easily

Uses reflection 43 IoCs

obfuscation

Processes:

train.stumble.easily

description	pid	process
Invokes method java.lang.Object.getClass	4230	train.stumble.easily
Invokes method android.content.res.AssetManager.addAssetPath	4230	train.stumble.easily
Invokes method android.app.ContextImpl.getAssets	4230	train.stumble.easily
Invokes method java.lang.Object.getClass	4230	train.stumble.easily
Invokes method android.content.res.AssetManager.open	4230	train.stumble.easily
Invokes method java.io.FilterInputStream.read	4230	train.stumble.easily
Invokes method java.io.FilterInputStream.read	4230	train.stumble.easily
Invokes method java.io.BufferedInputStream.read	4230	train.stumble.easily
Invokes method java.lang.Object.getClass	4230	train.stumble.easily
Invokes method java.io.BufferedInputStream.close	4230	train.stumble.easily
Invokes method java.lang.Object.getClass	4230	train.stumble.easily
Invokes method java.lang.String.getBytes	4230	train.stumble.easily
Invokes method java.lang.Object.getClass	4230	train.stumble.easily
Invokes method java.io.FileOutputStream.write	4230	train.stumble.easily
Invokes method java.lang.Object.getClass	4230	train.stumble.easily
Invokes method java.io.BufferedInputStream.close	4230	train.stumble.easily
Invokes method java.lang.Object.getClass	4230	train.stumble.easily
Invokes method java.io.FilterOutputStream.close	4230	train.stumble.easily
Invokes method android.app.ActivityThread.currentActivityThread	4230	train.stumble.easily
Acesses field android.app.ActivityThread.mPackages	4230	train.stumble.easily
Invokes method java.lang.reflect.Field.get	4230	train.stumble.easily
Invokes method java.lang.Object.getClass	4230	train.stumble.easily
Invokes method java.lang.ref.Reference.get	4230	train.stumble.easily
Invokes method java.lang.ref.Reference.get	4230	train.stumble.easily
Acesses field android.app.LoadedApk.mClassLoader	4230	train.stumble.easily
Invokes method java.lang.reflect.Field.get	4230	train.stumble.easily
Acesses field android.app.LoadedApk.mClassLoader	4230	train.stumble.easily
Invokes method dalvik.system.CloseGuard.get	4230	train.stumble.easily
Invokes method dalvik.system.CloseGuard.open	4230	train.stumble.easily
Invokes method android.security.NetworkSecurityPolicy.getInstance	4230	train.stumble.easily
Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted	4230	train.stumble.easily
Invokes method dalvik.system.CloseGuard.get	4230	train.stumble.easily
Invokes method dalvik.system.CloseGuard.open	4230	train.stumble.easily
Invokes method android.security.NetworkSecurityPolicy.getInstance	4230	train.stumble.easily
Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted	4230	train.stumble.easily
Invokes method dalvik.system.CloseGuard.get	4230	train.stumble.easily
Invokes method dalvik.system.CloseGuard.open	4230	train.stumble.easily
Invokes method android.security.NetworkSecurityPolicy.getInstance	4230	train.stumble.easily
Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted	4230	train.stumble.easily
Invokes method dalvik.system.CloseGuard.get	4230	train.stumble.easily
Invokes method dalvik.system.CloseGuard.open	4230	train.stumble.easily
Invokes method android.security.NetworkSecurityPolicy.getInstance	4230	train.stumble.easily
Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted	4230	train.stumble.easily

64 IoCs

Processes:

train.stumble.easily

pid	process
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily
4230	train.stumble.easily

train.stumble.easily
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses reflection
PID:4230

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads