alienbot | 381f3b60752d7eca83d02a1ab3df703969027468f9ddb3d7d0e99d671ef7c73e

Analysis

max time kernel
3766756s
max time network
138s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
20/05/2022, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

381f3b60752d7eca83d02a1ab3df703969027468f9ddb3d7d0e99d671ef7c73e.apk
Size

2.2MB
MD5

3adc3ddfcadfa1856df1e0d8f966856f
SHA1

5e821fcf4ba791f694589955b1dbade857be4ac0
SHA256

381f3b60752d7eca83d02a1ab3df703969027468f9ddb3d7d0e99d671ef7c73e
SHA512

fa827cf3a5907790621680ea18fb56d793e22923f18d84cf3097e1aaaae5ecf2624ecac156a7f3409cc3570fe96c277ecdb559ff48ae7676b20b178e98d0965e

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://malimaskim.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_DynamicOptDex/GlQx.json	5178	wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe
/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_DynamicOptDex/GlQx.json	5222	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_DynamicOptDex/GlQx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_DynamicOptDex/oat/x86/GlQx.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_DynamicOptDex/GlQx.json	5178	wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe

wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5178
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_DynamicOptDex/GlQx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_DynamicOptDex/oat/x86/GlQx.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5222

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_DynamicOptDex/GlQx.json

Filesize
719KB

MD5
42752b21103338574ffc13755a113ba9

SHA1
de8bfff1cf79ae16c59f17a44d4686e3d420cebd

SHA256
20f1cdbf27785b1b0d9e6d9bf98c5e3dd5812abdd4a04e42667c9a4bdd39aba4

SHA512
581b85a7a0b92998fa378331a8fdd7ae69cde94bd18acd5af71bbcf9ee0a09a18f3bfeca1802cc25df8e103874db248e425c94a74bc78284b1c0878021a106fd

Download Submit
/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_DynamicOptDex/GlQx.json

Filesize
719KB

MD5
472be0ae63a2703643d1440fde210876

SHA1
017ad4193f0f7f860189897f6fb6200945ceccbb

SHA256
65ac6791abf9c5adfeecfdc5660920d96eb03ed3d3920c1eea23a7d8e85f4721

SHA512
a2999941d60afdbcc80fb61ee75e5d4543bd3547643a5ee7203533a44e34e2f6052429b73bae7d12807bad66c07ebe2210b18dd4f899d19ac16f1caffb9e5ec3

Download Submit
/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_DynamicOptDex/GlQx.json

Filesize
719KB

MD5
c1c16698812c95b332e054d37835013b

SHA1
7f67646da01829b99c8567f77387352fe787f97f

SHA256
7add6b976332df8509affc9eaad3ab387fa7f92b23e0a7cd7172fba2657bb950

SHA512
eb6b4bd8e8235c34290b852af4980e8b9b7d7a2b6aaf46ae2847a886f90f83348f573f8be4ef491967bec701148940f39b846a4ad6588ea1ab3f6294830ead6b

Download Submit
/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_DynamicOptDex/GlQx.json

Filesize
719KB

MD5
472be0ae63a2703643d1440fde210876

SHA1
017ad4193f0f7f860189897f6fb6200945ceccbb

SHA256
65ac6791abf9c5adfeecfdc5660920d96eb03ed3d3920c1eea23a7d8e85f4721

SHA512
a2999941d60afdbcc80fb61ee75e5d4543bd3547643a5ee7203533a44e34e2f6052429b73bae7d12807bad66c07ebe2210b18dd4f899d19ac16f1caffb9e5ec3

Download Submit
/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
1fd30c441e46394227be4145735db8fd

SHA1
c1378a3a500212d790941db6aa34749c6624db92

SHA256
fab7ee30750a3bcd57bfcae01ff7cd9fa604c341206c13294c9c2e1404eaef55

SHA512
508dc74828e9c9e6e2aeaa954dc5bee994cb54a622f2c041ec1aa587a7463cdb4d06b7a60804fffca04e34c42110b4e29837b76adc2617ce906cf64c054a570e

Download Submit
/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_webview/Web Data-journal

Filesize
1KB

MD5
7d7b50ea4c6d938777ac679c6c91614c

SHA1
16f7967fd04d719fb36f1cdec53c4f385df599dd

SHA256
1c6a0f2f06c651e08bb921fa682f84a574fa2521e04455dc54bef2d8b598afb9

SHA512
b7134139764031e6ef4bd50a7f6608071942610d94f90cdb53daf20df5e738fd0e081bae9ad30545ddd81d51918dbc6303a45f7da8996d0b45cbe1926575c0f7

Download Submit
/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/app_webview/metrics_guid

Filesize
36B

MD5
4a332bcef4a24e9246c1871b73429090

SHA1
7cb3ad038de570079c1ea8328165bda9b2361190

SHA256
17cc9ee0a0e68332dc465f81f9786a6320fd83445c1bd8368b7e97b3e180c10d

SHA512
9fd0eb0dde72ba2aa7d00e001826421b3b2c8d5183e2de260e4efa12416ef2b1e66945d609fe385aa1713effac01f9de13fc53492da03df4a2816f0bf65f50ce

Download Submit
/data/user/0/wrtwlobjcyftp.telnkmccyrpsphamurdbbfeg.iuakcogfdfnzzawcmrfpe/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit