alienbot | ad8f6dcfc3924cc55ed9976ebc43dae03bb884af3d6cc89aee2373300f6258f2

General

Target

Chrome3.18.1.apk
Size

3.0MB
MD5

646d9d989a317e6a7b421cbd1d8cf337
SHA1

0284b51e1b7200b868b536021848a6be42a54bc0
SHA256

ad8f6dcfc3924cc55ed9976ebc43dae03bb884af3d6cc89aee2373300f6258f2
SHA512

b0484b305b0c7c9a09d6a8d25ca2c8677eabd2e6eb1f0e38a36fe0e5263a2fa2908690857630aeb7f83066a88b5af29b478228e46d0489c07fff74b79d9cbd46

Score

10^/10

alienbot banker infostealer obfuscation stealth trojan

Malware Config

Extracted

Family

alienbot

C2

http://fiollool.ga

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

inhale.network.help

pid process

4369 inhale.network.help

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

inhale.network.help

ioc	pid	process
/data/user/0/inhale.network.help/app_DynamicOptDex/Gpk.json	4369	inhale.network.help
/data/user/0/inhale.network.help/app_DynamicOptDex/Gpk.json	4369	inhale.network.help

Uses reflection 47 IoCs

obfuscation

Processes:

inhale.network.help

description	pid	process
Invokes method java.lang.Object.getClass	4369	inhale.network.help
Invokes method android.content.res.AssetManager.addAssetPath	4369	inhale.network.help
Invokes method android.app.ContextImpl.getAssets	4369	inhale.network.help
Invokes method java.lang.Object.getClass	4369	inhale.network.help
Invokes method android.content.res.AssetManager.open	4369	inhale.network.help
Invokes method java.io.FilterInputStream.read	4369	inhale.network.help
Invokes method java.io.FilterInputStream.read	4369	inhale.network.help
Invokes method java.io.BufferedInputStream.read	4369	inhale.network.help
Invokes method java.lang.Object.getClass	4369	inhale.network.help
Invokes method java.io.BufferedInputStream.close	4369	inhale.network.help
Invokes method java.lang.Object.getClass	4369	inhale.network.help
Invokes method java.lang.String.getBytes	4369	inhale.network.help
Invokes method java.lang.Object.getClass	4369	inhale.network.help
Invokes method java.io.FileOutputStream.write	4369	inhale.network.help
Invokes method java.lang.Object.getClass	4369	inhale.network.help
Invokes method java.io.BufferedInputStream.close	4369	inhale.network.help
Invokes method java.lang.Object.getClass	4369	inhale.network.help
Invokes method java.io.FilterOutputStream.close	4369	inhale.network.help
Invokes method android.app.ActivityThread.currentActivityThread	4369	inhale.network.help
Acesses field android.app.ActivityThread.mPackages	4369	inhale.network.help
Invokes method java.lang.reflect.Field.get	4369	inhale.network.help
Invokes method java.lang.Object.getClass	4369	inhale.network.help
Invokes method java.lang.ref.Reference.get	4369	inhale.network.help
Invokes method java.lang.ref.Reference.get	4369	inhale.network.help
Acesses field android.app.LoadedApk.mClassLoader	4369	inhale.network.help
Invokes method java.lang.reflect.Field.get	4369	inhale.network.help
Acesses field android.app.LoadedApk.mClassLoader	4369	inhale.network.help
Invokes method dalvik.system.CloseGuard.get	4369	inhale.network.help
Invokes method dalvik.system.CloseGuard.open	4369	inhale.network.help
Invokes method android.security.NetworkSecurityPolicy.getInstance	4369	inhale.network.help
Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted	4369	inhale.network.help
Invokes method dalvik.system.CloseGuard.get	4369	inhale.network.help
Invokes method dalvik.system.CloseGuard.open	4369	inhale.network.help
Invokes method android.security.NetworkSecurityPolicy.getInstance	4369	inhale.network.help
Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted	4369	inhale.network.help
Invokes method dalvik.system.CloseGuard.get	4369	inhale.network.help
Invokes method dalvik.system.CloseGuard.open	4369	inhale.network.help
Invokes method android.security.NetworkSecurityPolicy.getInstance	4369	inhale.network.help
Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted	4369	inhale.network.help
Invokes method dalvik.system.CloseGuard.get	4369	inhale.network.help
Invokes method dalvik.system.CloseGuard.open	4369	inhale.network.help
Invokes method android.security.NetworkSecurityPolicy.getInstance	4369	inhale.network.help
Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted	4369	inhale.network.help
Invokes method dalvik.system.CloseGuard.get	4369	inhale.network.help
Invokes method dalvik.system.CloseGuard.open	4369	inhale.network.help
Invokes method android.security.NetworkSecurityPolicy.getInstance	4369	inhale.network.help
Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted	4369	inhale.network.help

64 IoCs

Processes:

inhale.network.help

pid	process
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help
4369	inhale.network.help

inhale.network.help
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses reflection
PID:4369

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads