alienbot | ca4bf446ab44314ec4aa8d06034af2bd1e40455665ccd9ff48cfef5234bc678c

Analysis

max time kernel
3814581s
max time network
157s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
20/05/2022, 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca4bf446ab44314ec4aa8d06034af2bd1e40455665ccd9ff48cfef5234bc678c.apk
Size

1.5MB
MD5

3a41995a56fb1daa066d0c8c6464c861
SHA1

4ed5c16e3e7212d18e3804e9f42a7f90e6eef24d
SHA256

ca4bf446ab44314ec4aa8d06034af2bd1e40455665ccd9ff48cfef5234bc678c
SHA512

be5e017bd5cd1e03c880245fbdb30e99b1e46bcf0f5e7c23c735b05bac07f9cb388fb19c1d3d5b076e52f95bdfc67e31403393afddb8d045bd0bb362159b0c95

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://nesenbenibitirebildin.cyou

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_DynamicOptDex/Mfhm.json	5271	hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd
/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_DynamicOptDex/Mfhm.json	5331	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_DynamicOptDex/Mfhm.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_DynamicOptDex/oat/x86/Mfhm.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_DynamicOptDex/Mfhm.json	5271	hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd

hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5271
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_DynamicOptDex/Mfhm.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_DynamicOptDex/oat/x86/Mfhm.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5331

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_DynamicOptDex/Mfhm.json

Filesize
695KB

MD5
fbc591cdfc9384907903aabdf3b789d3

SHA1
cd323e9e9eee6151692fe3a2281bddbcbc6bdbbb

SHA256
5cfeb8bdeebe5e9c7066e2b6ea16adc48331e166ca1ac0831c1253ed87606047

SHA512
37369a333aaf05f87042f05e4387f32727b4196296548ef4f71484859e0c551796b342836133b218d4f6c849724f5fb835842fd0618a75ee791a9905e6416c7e

Download Submit
/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_DynamicOptDex/Mfhm.json

Filesize
695KB

MD5
41c03ceb562697bca859df75b1ca5e3c

SHA1
e07c832d29157eec1daff82a399788dfd91038bc

SHA256
dc749d6e0197a2bc3059c3e1b134b3654c3873aeca05acf3d23c62a2f8946a7e

SHA512
76cb36ae825b3fd8a0f310cca4529f23c4c345c14e4b8cd39feafb45e42499190f20651b0c40eae98461d1232bed64e0d1927765af2ae85bbbab2b2556891eb2

Download Submit
/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_DynamicOptDex/Mfhm.json

Filesize
695KB

MD5
2914278a8360b5f8bd49980f0081e58d

SHA1
053c561874c96db8603470d2b6318dcbc90901e5

SHA256
b4db7c76a90e3d98e8f2de11c5e4612318807899c5a18e8d44a133d4073bc2a8

SHA512
dc55640cb289879a470b1d0f5e3a02afd57c504c43702f0b50c6ba2233b9934e2ee5a1073b8fc6fe84b02b841595496f8fa05988427f4224db5e287dae578929

Download Submit
/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_DynamicOptDex/Mfhm.json

Filesize
695KB

MD5
41c03ceb562697bca859df75b1ca5e3c

SHA1
e07c832d29157eec1daff82a399788dfd91038bc

SHA256
dc749d6e0197a2bc3059c3e1b134b3654c3873aeca05acf3d23c62a2f8946a7e

SHA512
76cb36ae825b3fd8a0f310cca4529f23c4c345c14e4b8cd39feafb45e42499190f20651b0c40eae98461d1232bed64e0d1927765af2ae85bbbab2b2556891eb2

Download Submit
/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
38c5e87b1574e44425748a335611a5f6

SHA1
dad5ac33a22fcdc080258ef36d97de8747035896

SHA256
8cf1741335b5368b81db81c10b65277d9dd35ecd910210260f4b274085ec8ee7

SHA512
d40b11201e58ad71f97db9e450c5e534a97313446847218f16271a91d008a581cd3e576ece1b4cda0c128189c7f2ab402e8070ddcefc6f91a982587e0feaf344

Download Submit
/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_webview/Web Data-journal

Filesize
1KB

MD5
5348789dbbdcf33c5e85debdd1b1c80e

SHA1
c6fc46b189af4e5cef7a211ac2f8495c88ec7858

SHA256
ea31da3be61f0a8559149ce1fed74295e499fa16f930951303d6333840391fb0

SHA512
b5dd638cee15b467811605ae64fb7234899f526c31cf262a9ceee42b4e89001c32371bcba2dc5415eb4472b4e864d8c22d89682aea32e8a72191d63acefd43c3

Download Submit
/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/app_webview/metrics_guid

Filesize
36B

MD5
6bc756ba973e3c5686fe58fbaf7f4d29

SHA1
f0c76e3d962aae089c543bced10d4be13666e72a

SHA256
338fe72753131afbf3371762ce64d286a42b10c99b23d6fdc573e14ff1916f89

SHA512
c4ad9c43984fdf4f3fb548b314eb3f9934701a4dc3985c8d4182385fb1dbbe814701a14895a75b06447114c9daa79ab3a10ac16a2f9b0d2d6264054966389a9e

Download Submit
/data/user/0/hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit