alienbot | 34d686218a7a221d44299d62145d7641f71b8a17321b50cb3884e19f66c04126

General

Target

34d686218a7a221d44299d62145d7641f71b8a17321b50cb3884e19f66c04126.apk
Size

1.5MB
MD5

d8047be7c6a084f2bc08c346073dd8d8
SHA1

0aac337499f8283e7e8d37d9532a2cd5c1422719
SHA256

34d686218a7a221d44299d62145d7641f71b8a17321b50cb3884e19f66c04126
SHA512

0ee5001b1bb84dc97c767bc7e94c30d75436ec772e92bf9f74b4194eeb5d48e0237de593061dfaa07f0d39e1ef2aefc52393d48310e4b952f1ec85e94a6d7fb5

Score

10^/10

alienbot banker infostealer trojan

Malware Config

Extracted

Family

alienbot

C2

http://elondauned.xyz/

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/Mb.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/oat/x86/Mb.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/Mb.json	5121	eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd
/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/Mb.json	5148	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/Mb.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/oat/x86/Mb.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/Mb.json	5121	eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd

eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5121
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/Mb.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/oat/x86/Mb.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/Mb.json

Filesize
731KB

MD5
c3c233c39aaea59ad7bc203d31c3bfb6

SHA1
9b35fa18b01ac6820239b2872ca0c3f6a5272314

SHA256
3f0a83f006aeca52e60a1b0746a1d857ca25f316605237d8bee023375c4852eb

SHA512
d46b30bf1dff9e4ec359c03c98f9ba5414ca14d7110caaeffae86565f08e06337207d83819015a8dbba4a51adaaf005b08534fc4630d0475050cf207aa314b9a

Download Submit
/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/Mb.json

Filesize
731KB

MD5
169f416fee37927b4c408151ba37e61b

SHA1
8f466c3cf5ab73f2bd3ab477bd69c36304b2cb10

SHA256
05b412cdbf39324ac2374cf590ce3ebb1efec1a787d5a25fa718f3fc8ad7d0fa

SHA512
2aa7e4d6abaf5106be431e58f987f723af474864988255d9dd670d858b678048da74599008996cfdf23d0be13bd34adbf43464de4a2991143b9f0d5f2d7675e4

Download Submit
/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/Mb.json

Filesize
731KB

MD5
9f17f4ccb7f1fecfa1bd29ee7f985fd2

SHA1
945d3f1691d58db78860e2f48598b2175f06573e

SHA256
e65d471d385a36bccca55bb000a6b154bbc4a11b9e8fd3270ec3b0c72f423c7f

SHA512
9fe2a403498a66460a5c23955b55f70f4148e5006c4a79fff963c477211037ae42c8105bb50a7f6b81269deca40d5470b4a8e99f37c714ae5f522b425ad4d7b1

Download Submit
/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/Mb.json

Filesize
731KB

MD5
169f416fee37927b4c408151ba37e61b

SHA1
8f466c3cf5ab73f2bd3ab477bd69c36304b2cb10

SHA256
05b412cdbf39324ac2374cf590ce3ebb1efec1a787d5a25fa718f3fc8ad7d0fa

SHA512
2aa7e4d6abaf5106be431e58f987f723af474864988255d9dd670d858b678048da74599008996cfdf23d0be13bd34adbf43464de4a2991143b9f0d5f2d7675e4

Download Submit
/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/Mb.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/oat/Mb.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/oat/x86/Mb.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/oat/x86/Mb.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing