alienbot | be7ad2f567ac30ba144370fc481aad30bb6c0f70d64ab165d822d2f0a46fc39c

Resubmissions

13/05/2022, 20:54

220513-zp5r6sechm 10

10/05/2022, 14:58

220510-sb53fscaek 10

Analysis

max time kernel
2927393s
max time network
156s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
10/05/2022, 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3d0965c2e93b338a62ecdfa477ca380cad9e6105a51fef31567ae1a8d291e9e.apk
Size

976KB
MD5

a2077725a888217fffeec140a73325c2
SHA1

f36abdfbd158c88f3661a6f6ee68dadddff4e1d7
SHA256

f3d0965c2e93b338a62ecdfa477ca380cad9e6105a51fef31567ae1a8d291e9e
SHA512

a070ef91ccc0aa58d85d2b126369bc1b8ff719c6b7f89c6e97fbe2238e6d20dcc512e057ebf09b4ed460cc7d29d48a5e5170e04424f3bedb8199d4a1d98cb308

Score

10^/10

alienbot banker infostealer trojan

Malware Config

Extracted

Family

alienbot

http://lluxll.digital

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.valley.bamboo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.valley.bamboo

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.valley.bamboo

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.valley.bamboo/app_DynamicOptDex/yD.json	5833	com.valley.bamboo

com.valley.bamboo
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:5833
- getprop ro.miui.ui.version.name
  2⤵
  PID:5926
- getprop ro.miui.ui.version.name
  2⤵
  PID:6108
- getprop ro.miui.ui.version.name
  2⤵
  PID:6150
- getprop ro.miui.ui.version.name
  2⤵
  PID:6221
- getprop ro.miui.ui.version.name
  2⤵
  PID:6258
- getprop ro.miui.ui.version.name
  2⤵
  PID:6289
- getprop ro.miui.ui.version.name
  2⤵
  PID:6323

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.valley.bamboo/app_DynamicOptDex/yD.json

Filesize
238KB

MD5
f1009725383ca50b07f5f5ead1a85fd1

SHA1
bd82135b18706985419100f58076e7441f3db8b4

SHA256
411d5a109035c3530d162f005e1c475d6a1b764ca228d6a9af87079ca4c5b2af

SHA512
e77dc2dd34e31706d86ff6e7ecb4463d9390d641ea008fdf2166f8dd9bca444e0096d3af7bf9adb2e388ff211ecad738b00de2da77380146a7b23c4074f242cb

Download Submit
/data/user/0/com.valley.bamboo/app_DynamicOptDex/yD.json

Filesize
483KB

MD5
f13b7d41aa8f192baa475216b94ad6a9

SHA1
bbb518ccec34528f39ea086d92f1af743d7e61e3

SHA256
191d4848a27cd708c8790c45d2f80cbaa798f5e8cef30cccf7f445b0b830c2fa

SHA512
9bc1f585e9efd7362deee30a921f5070a01d4efc793b5cc72911c457642bd5c49441ffa3deabdf11c61405b47a512d46ddd95b2a8b61ef367506a44d5c58b672

Download Submit