alienbot | 4d0d0267bb21c04426021f34606e633d9dc0fb26e07a3a7d6c3478a773cd0257

Analysis

max time kernel
4008529s
max time network
132s
platform
android_x86_64
resource
android-x86_64_arm64
submitted
20-04-2021 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chrome.apk
Size

3.6MB
MD5

84c40a260b064e5b49d36b1c95cd6d26
SHA1

3dead78d0a1378d698bc26e31aa7e27ee46adba5
SHA256

4d0d0267bb21c04426021f34606e633d9dc0fb26e07a3a7d6c3478a773cd0257
SHA512

5bcdfe9d43d39a2085b1664b51260834f335bb9f971e6f7b5cebece8b415fbc416699e12113099930c0898d1b4ea12aa6b4b3263e8d4964618159d04851f27ee

Score

10^/10

alienbot banker infostealer obfuscation stealth trojan

Malware Config

Extracted

Family

alienbot

http://hostgamesesdeses.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

myth.cupboard.cause

pid process

4491 myth.cupboard.cause

pid	process
4491	myth.cupboard.cause

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

myth.cupboard.cause

ioc	pid	process
/data/user/0/myth.cupboard.cause/app_DynamicOptDex/GZtnTI.json	4491	myth.cupboard.cause
/data/user/0/myth.cupboard.cause/app_DynamicOptDex/GZtnTI.json	4491	myth.cupboard.cause

Uses reflection 32 IoCs

obfuscation

Processes:

myth.cupboard.cause

description	pid	process
Invokes method java.lang.Object.getClass	4491	myth.cupboard.cause
Invokes method android.content.res.AssetManager.addAssetPath	4491	myth.cupboard.cause
Invokes method android.app.ContextImpl.getAssets	4491	myth.cupboard.cause
Invokes method java.lang.Object.getClass	4491	myth.cupboard.cause
Invokes method android.content.res.AssetManager.open	4491	myth.cupboard.cause
Invokes method java.io.FilterInputStream.read	4491	myth.cupboard.cause
Invokes method java.io.FilterInputStream.read	4491	myth.cupboard.cause
Invokes method java.io.BufferedInputStream.read	4491	myth.cupboard.cause
Invokes method java.lang.Object.getClass	4491	myth.cupboard.cause
Invokes method java.io.BufferedInputStream.close	4491	myth.cupboard.cause
Invokes method java.lang.Object.getClass	4491	myth.cupboard.cause
Invokes method java.lang.String.getBytes	4491	myth.cupboard.cause
Invokes method java.lang.Object.getClass	4491	myth.cupboard.cause
Invokes method java.io.FileOutputStream.write	4491	myth.cupboard.cause
Invokes method java.lang.Object.getClass	4491	myth.cupboard.cause
Invokes method java.io.BufferedInputStream.close	4491	myth.cupboard.cause
Invokes method java.lang.Object.getClass	4491	myth.cupboard.cause
Invokes method java.io.FilterOutputStream.close	4491	myth.cupboard.cause
Invokes method android.app.ActivityThread.currentActivityThread	4491	myth.cupboard.cause
Acesses field android.app.ActivityThread.mPackages	4491	myth.cupboard.cause
Invokes method java.lang.reflect.Field.get	4491	myth.cupboard.cause
Invokes method java.lang.Object.getClass	4491	myth.cupboard.cause
Invokes method java.lang.ref.Reference.get	4491	myth.cupboard.cause
Invokes method java.lang.ref.Reference.get	4491	myth.cupboard.cause
Acesses field android.app.LoadedApk.mClassLoader	4491	myth.cupboard.cause
Invokes method java.lang.reflect.Field.get	4491	myth.cupboard.cause
Acesses field android.app.LoadedApk.mClassLoader	4491	myth.cupboard.cause
Invokes method dalvik.system.CloseGuard.get	4491	myth.cupboard.cause
Invokes method dalvik.system.CloseGuard.open	4491	myth.cupboard.cause
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	4491	myth.cupboard.cause
Invokes method dalvik.system.CloseGuard.get	4491	myth.cupboard.cause
Invokes method dalvik.system.CloseGuard.open	4491	myth.cupboard.cause

myth.cupboard.cause
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses reflection
PID:4491

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads