alienbot | 2b2d0dd04e272ea821c114a8366efc7651c56a548af2d488d8616bb25682cb72

Analysis

Target

2b2d0dd04e272ea821c114a8366efc7651c56a548af2d488d8616bb25682cb72.apk
Size

1.5MB
MD5

c4693822db3636a03cbfc607550b19ac
SHA1

52c16ec013db6f2854123e6b21d5686ef453bfbd
SHA256

2b2d0dd04e272ea821c114a8366efc7651c56a548af2d488d8616bb25682cb72
SHA512

60506b38da5c1bb405e82b5450dda7fafb68397d232730a252698cfc2633d02288e101862d0e76ebef4cc3684327c273e9599adbeb74bcc98e48406847773f1a

Score

10^/10

Family

alienbot

http://darkwhitechoco.top

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq/app_DynamicOptDex/Yltq.json	5629	mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq
/data/user/0/mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq/app_DynamicOptDex/Yltq.json	5629	mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq

mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5629
- mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq
  2⤵
  PID:6318
- mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq
  2⤵
  PID:6820
- mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq
  2⤵
  PID:6857
- mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq
  2⤵
  PID:7046
- mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq
  2⤵
  PID:7077
- mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq
  2⤵
  PID:7112
- mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq
  2⤵
  PID:7142