alienbot | 1c01e25fea90370e20e732638cf7aed059c167e72915864fb53e65e716bc1060

Analysis

max time kernel
171117s
max time network
140s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
08-04-2022 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afdcf9e488413652659a551ff9388a81101228273bef2cfcdd7121e0bdb6a0fd.apk
Size

1.9MB
MD5

4676030b254286ce7fe7501e7eafd31f
SHA1

04283f5d707b86cf097178fdf09a64a6623467f6
SHA256

afdcf9e488413652659a551ff9388a81101228273bef2cfcdd7121e0bdb6a0fd
SHA512

bd71d384c257595f4fc881c57b8a955bfed62cf8a765bb028e109fcbcaa5bfe4a6a1e032877216d73d6c19e57323b1aca460a58027733c961850af35b5c1d192

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://adsdsadsalifsa.digital

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.pull.people

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.pull.people
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.pull.people

Acquires the wake lock. 1 IoCs

Processes:

com.pull.people

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pull.people

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pull.people/app_DynamicOptDex/rpO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.pull.people/app_DynamicOptDex/oat/x86/rpO.odex --compiler-filter=quicken --class-loader-context=&com.pull.people

ioc	pid	Process
/data/user/0/com.pull.people/app_DynamicOptDex/rpO.json	5154	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pull.people/app_DynamicOptDex/rpO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.pull.people/app_DynamicOptDex/oat/x86/rpO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.pull.people/app_DynamicOptDex/rpO.json	5107	com.pull.people

Removes a system notification. 1 IoCs

evasion

Processes:

com.pull.people

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.pull.people

com.pull.people
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5107
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pull.people/app_DynamicOptDex/rpO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.pull.people/app_DynamicOptDex/oat/x86/rpO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5154

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.pull.people/app_DynamicOptDex/oat/rpO.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.pull.people/app_DynamicOptDex/oat/x86/rpO.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.pull.people/app_DynamicOptDex/oat/x86/rpO.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.pull.people/app_DynamicOptDex/rpO.json

Filesize
238KB

MD5
7499213fe33df9ab281fbde82df166f4

SHA1
d5984db8ec75f91f6427a8d19d6f8a2f9c2d9841

SHA256
2335773ddcfe28b88f604397c905072f2b61e90251cf95a9f2f84aa4ded9e054

SHA512
65e4dba8902d03d15e6b8482b22f7de2bf77edf714c5c0e179330ef6ad345c7c3962a0893d1f9ff40e55480e269f4cd42e4afaed8928580b2c25459b7220473e

Download Submit
/data/user/0/com.pull.people/app_DynamicOptDex/rpO.json

Filesize
483KB

MD5
0729c0dad7c8266d20e9c04933dba5c2

SHA1
ec451a313ad8a6f840c3e282bfbcc03ed2fced78

SHA256
60f55a759662157fa451b52a7a5d8fba5e50375505594d012aef9194d9127265

SHA512
a12ca3b0a9ac335f8c8869ca881356c58d738fad29324fc687006f86daacf2b187905f809be6099a548b3912ed4e8208c495e114427c6e87406152032b6b9eeb

Download Submit
/data/user/0/com.pull.people/app_DynamicOptDex/rpO.json

Filesize
483KB

MD5
f4d8edec131cef598ad563dd645af79a

SHA1
104580d35d00f187346c5319cbe1b29f9104740c

SHA256
a67b615cfb7b24b0066e05b6a7b84e577566688c0d2a1e53166cf7a72a3a2452

SHA512
afee67953f0f9dae370a51b764abc996a0dc095ba42ad37479d910d9d2076fbf0056116c616154268f4cc8e51b4d4f0ee907cc01a6820ae1b321d7e1bc71ac8e

Download Submit
/data/user/0/com.pull.people/app_DynamicOptDex/rpO.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.pull.people/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.pull.people/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
0600f1b5f2c9fb626d80d46aa3fd202e

SHA1
45a390137fde96e90585550fd84dea8b005e1ba4

SHA256
fe9dc101794b19cf5f4f86074e4afc603cddd3e965790ccfd64715aea68774bb

SHA512
7f4d4e457895bfd9b6a68e63324ef901ae6ac870fb1d75234398c34cd337f64391d21c406163c8bd6d0ea7ce5733533fd087b629ff920c3727528b79d41477d2

Download Submit
/data/user/0/com.pull.people/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.pull.people/app_webview/Web Data-journal

Filesize
1KB

MD5
b22264cf9af58265e5a2754972b52eaf

SHA1
e1a6aea4b40615e360bc28f52476dfbc4fa6f9d0

SHA256
d4f7c7f460ac4309205329fd9b01267fde351845712c03dea4b0c64908f3e1d5

SHA512
42e4f81f0e369fedabb5edd05b73a6e1ccc413939f5c06ac9037f4ea0b98d19340842c63bc644293e5ff4711665932315ef1f586613f7c91716d2a502c009efc

Download Submit
/data/user/0/com.pull.people/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.pull.people/app_webview/metrics_guid

Filesize
36B

MD5
ee75e4c2125b737f5e687c1a9acf5b70

SHA1
32a6d8d20abb371656634d4919075079a752b348

SHA256
64d76c5228a9b36fc3c81ed23df6d9765b987c84b3b96af5745fd61c16f90d05

SHA512
16fb144d914c86bfa1892090d3bbebe7d2730d947b1578e247cbd2b6a7cda88fe8bdd2ec220b0b19f085f125df238c8cca0dc2dbe7ab88ad80e6ccbf7cbc8d52

Download Submit
/data/user/0/com.pull.people/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.pull.people/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.pull.people/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.pull.people/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit