alienbot | 163c2cff8cd941dbce727de2df9df5fdfaaddde8f6d3db86270e2abf7e0ea19f | Triage

Analysis

max time kernel
4079711s
max time network
154s
platform
android_x86
resource
android-x86-arm
submitted
13/02/2022, 12:51

Sharing

Report Analysis Logs

General

Target

163c2cff8cd941dbce727de2df9df5fdfaaddde8f6d3db86270e2abf7e0ea19f.apk
Size

2.2MB
MD5

43af9a0afff6a08f37ae4426a87fd5bf
SHA1

9a441ece55c1beb6011891918cfc27877fb5c911
SHA256

163c2cff8cd941dbce727de2df9df5fdfaaddde8f6d3db86270e2abf7e0ea19f
SHA512

5704c3016dca1f6763d44fc72826a041f8a55214d195f5ffb15d06b3bec025ac8fe6c5d7a8c01ad3bcf111a3d9a1e38076c99f3cf43700934d099b99d808e738

Score

10^/10

alienbot banker infostealer trojan

Malware Config

Extracted

Family

alienbot

C2

http://fsadkafasdkfka.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ldpgteqpernpguirqtltzsyegxj.edllabrcpucxwbbysloruoiaw.xmbzotblnfxjjbbatmnbl

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ldpgteqpernpguirqtltzsyegxj.edllabrcpucxwbbysloruoiaw.xmbzotblnfxjjbbatmnbl

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/ldpgteqpernpguirqtltzsyegxj.edllabrcpucxwbbysloruoiaw.xmbzotblnfxjjbbatmnbluskpgw/app_DynamicOptDex/BNEHgbJ.json	4915	ldpgteqpernpguirqtltzsyegxj.edllabrcpucxwbbysloruoiaw.xmbzotblnfxjjbbatmnbl
/data/user/0/ldpgteqpernpguirqtltzsyegxj.edllabrcpucxwbbysloruoiaw.xmbzotblnfxjjbbatmnbluskpgw/app_DynamicOptDex/BNEHgbJ.json	4979	/system/bin/dex2oat
/data/user/0/ldpgteqpernpguirqtltzsyegxj.edllabrcpucxwbbysloruoiaw.xmbzotblnfxjjbbatmnbluskpgw/app_DynamicOptDex/BNEHgbJ.json	4915	ldpgteqpernpguirqtltzsyegxj.edllabrcpucxwbbysloruoiaw.xmbzotblnfxjjbbatmnbl

ldpgteqpernpguirqtltzsyegxj.edllabrcpucxwbbysloruoiaw.xmbzotblnfxjjbbatmnbl
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:4915
- ldpgteqpernpguirqtltzsyegxj.edllabrcpucxwbbysloruoiaw.xmbzotblnfxjjbbatmnbl
  2⤵
  PID:4979
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:4979

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads