alienbot | be7ad2f567ac30ba144370fc481aad30bb6c0f70d64ab165d822d2f0a46fc39c

Resubmissions

13/05/2022, 20:54

220513-zp5r6sechm 10

10/05/2022, 14:58

220510-sb53fscaek 10

Analysis

max time kernel
3207984s
max time network
152s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
13/05/2022, 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3d0965c2e93b338a62ecdfa477ca380cad9e6105a51fef31567ae1a8d291e9e.apk
Size

976KB
MD5

a2077725a888217fffeec140a73325c2
SHA1

f36abdfbd158c88f3661a6f6ee68dadddff4e1d7
SHA256

f3d0965c2e93b338a62ecdfa477ca380cad9e6105a51fef31567ae1a8d291e9e
SHA512

a070ef91ccc0aa58d85d2b126369bc1b8ff719c6b7f89c6e97fbe2238e6d20dcc512e057ebf09b4ed460cc7d29d48a5e5170e04424f3bedb8199d4a1d98cb308

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://lluxll.digital

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.valley.bamboo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.valley.bamboo

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.valley.bamboo

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.valley.bamboo/app_DynamicOptDex/yD.json	5155	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.valley.bamboo/app_DynamicOptDex/yD.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.valley.bamboo/app_DynamicOptDex/oat/x86/yD.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.valley.bamboo/app_DynamicOptDex/yD.json	5110	com.valley.bamboo

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.valley.bamboo

com.valley.bamboo
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5110
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.valley.bamboo/app_DynamicOptDex/yD.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.valley.bamboo/app_DynamicOptDex/oat/x86/yD.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5155

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.valley.bamboo/app_DynamicOptDex/yD.json

Filesize
238KB

MD5
f1009725383ca50b07f5f5ead1a85fd1

SHA1
bd82135b18706985419100f58076e7441f3db8b4

SHA256
411d5a109035c3530d162f005e1c475d6a1b764ca228d6a9af87079ca4c5b2af

SHA512
e77dc2dd34e31706d86ff6e7ecb4463d9390d641ea008fdf2166f8dd9bca444e0096d3af7bf9adb2e388ff211ecad738b00de2da77380146a7b23c4074f242cb

Download Submit
/data/user/0/com.valley.bamboo/app_DynamicOptDex/yD.json

Filesize
483KB

MD5
3f6d920132228d4a7b0ebd74f366451c

SHA1
0bdbc5a48d615181c1a2db91a43a0857462c38cd

SHA256
b5bb4c4f7c4df362714f01ca51b3560442459cc950ec528e0340653037c6f30c

SHA512
d410d75f10691559f5b9ff568cff128eba8c1791099ea35549df5bb8501b32a494df07975031090adbe49fdf8082971c8e67e713e9b5c3a875f80a56d07de09d

Download Submit
/data/user/0/com.valley.bamboo/app_DynamicOptDex/yD.json

Filesize
483KB

MD5
f13b7d41aa8f192baa475216b94ad6a9

SHA1
bbb518ccec34528f39ea086d92f1af743d7e61e3

SHA256
191d4848a27cd708c8790c45d2f80cbaa798f5e8cef30cccf7f445b0b830c2fa

SHA512
9bc1f585e9efd7362deee30a921f5070a01d4efc793b5cc72911c457642bd5c49441ffa3deabdf11c61405b47a512d46ddd95b2a8b61ef367506a44d5c58b672

Download Submit
/data/user/0/com.valley.bamboo/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.valley.bamboo/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
35058da883d17d8bffa51380407f929d

SHA1
b947a3bb1c974874bb81798991a4d259eb01b063

SHA256
b11e3d0d5a550be7cb8fb30220d3d9e3c67f1ff52e1f3b337beb3910a6d14ef9

SHA512
07d9e5871b34e8a380a84dd627ed52d430fba7bfc8cb02a8584e51bba75038e1020297271a14f432a79d2cacdba7d543d47d15c45250468c67264f8b1732ba46

Download Submit
/data/user/0/com.valley.bamboo/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.valley.bamboo/app_webview/Web Data-journal

Filesize
1KB

MD5
b4a4188d2bf3a6dce444370e966c2632

SHA1
ef4bf64f35d2431edb44e8de8e120737beb02626

SHA256
dc18345709f059f803380b0eeeb1a7f4a29e0392085798c19d969e1482173c65

SHA512
82eb177332685b9e068a6dab2e783f38f90b901c34bbf302fb9895d6f8343089b43cc3a4c64ee46049b425b63c1e49a75dcccf6228ef05d618f59e64163314c1

Download Submit
/data/user/0/com.valley.bamboo/app_webview/metrics_guid

Filesize
36B

MD5
8bef5be9d1e31c76ba65cb13e97ec4ce

SHA1
147515158f5e0823c099f8d77db2151acace8ee4

SHA256
103f659bcf683ce403f79276ef4a962a00080d7f2224501882d420e1b342ce55

SHA512
c16999df4a6a51732384a045043f810a7a75284af5d70b2299ca3fe9b3032c457a1963f99fabae8b5722dfe164c3171ef001a173f06953669b1c9b59fac0eb80

Download Submit
/data/user/0/com.valley.bamboo/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit