alienbot | dafc457d7005b4cbdadf7c0060bc8350e83306a564dc279feb701e55d1c13532

Analysis

max time kernel
3843841s
max time network
146s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
21/05/2022, 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dafc457d7005b4cbdadf7c0060bc8350e83306a564dc279feb701e55d1c13532.apk
Size

1.5MB
MD5

8ca18d9c60d1bf540877f99b3569943f
SHA1

ad201003c45f45147a3745100b47ef4acf3ce8c6
SHA256

dafc457d7005b4cbdadf7c0060bc8350e83306a564dc279feb701e55d1c13532
SHA512

5d8469559f1eea724a5d703fa49e5e2059653e52c8b7ebe91c6fac3c1cc8421379b5db5812ae78377b6ad8f3e9ab6ba018f3a7724f2fb4019a66d9b1c57e51ff

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://odricatt.live

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	inmfdyqgouclkrfqty.uoenpnmz.qww
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	inmfdyqgouclkrfqty.uoenpnmz.qww

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json	5047	inmfdyqgouclkrfqty.uoenpnmz.qww
/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json	5114	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/oat/x86/DAQKO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json	5047	inmfdyqgouclkrfqty.uoenpnmz.qww

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	inmfdyqgouclkrfqty.uoenpnmz.qww

inmfdyqgouclkrfqty.uoenpnmz.qww
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5047
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/oat/x86/DAQKO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5114

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json

Filesize
720KB

MD5
cc7e7cad148aa82b53de28d65dd6570a

SHA1
88c82b0ea3e5d8448b960e99f40ec9dd9c0db82f

SHA256
30f0a5ceaae445b55d0a22b1be54fb3308729f812224f4c05317ee8a129e4891

SHA512
daa16cc68bd3489ac85fb008a34876bd2e4a531321f47db42d902c3198f720f659b7aad1cf28dcfe41ab2697be2967dabbe9963c74a80550eea8e1ea3a3cc64e

Download Submit
/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json

Filesize
720KB

MD5
c8c7377c2e956d6bfc465252fc6c106e

SHA1
1f9e92c9e44442c4f0eb6d1753af754fc9904d87

SHA256
dff426d0fce83ed7dbc85f1a304f0a84c93b2c5045390dd10a42710ce1d80e9b

SHA512
ee281e74dd6dc69fcf2c2f31bc2fa1ea24f491e2764dcc5924202d7eee877bd914838427820a1506730450bed96000f855468d9d5aa3704922fcece33e28778e

Download Submit
/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json

Filesize
720KB

MD5
bb6f9096436270269bfcccdc34d12e83

SHA1
7854c45bd234b955d1678cabee11d66e8d4f5fc7

SHA256
72850397e4774f0abae710e89e88f9c09f12de68b30a8623b71be8227bbb3133

SHA512
2762c0c913ffcbf8264cfaeebfcea5ce251ce9f8545f93d3954ea8dad2a40ca0861b33edafb12af99f7d11a7ec1f779da413ccb6a9bf2fe665e9064e6a3df870

Download Submit
/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json

Filesize
720KB

MD5
c8c7377c2e956d6bfc465252fc6c106e

SHA1
1f9e92c9e44442c4f0eb6d1753af754fc9904d87

SHA256
dff426d0fce83ed7dbc85f1a304f0a84c93b2c5045390dd10a42710ce1d80e9b

SHA512
ee281e74dd6dc69fcf2c2f31bc2fa1ea24f491e2764dcc5924202d7eee877bd914838427820a1506730450bed96000f855468d9d5aa3704922fcece33e28778e

Download Submit
/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
603a2f01065e9a4b9587d21ace08bc71

SHA1
84fe84e4cb1f7060d13634452915fd756cc3ce03

SHA256
400d79754704274841f41614da6514baee29082df42c75b1627b774ae4664f7e

SHA512
6f3e6470d0a64c14b369f87c591f241011e575a18722be56dbcc2d7aa6a22b19cab026634e5376381a6e693e32e073b7be6016b9c56909e93d3d9931c7ba88e5

Download Submit
/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
7da120e5a2e11892bb4c922db78f9720

SHA1
e2df24e8bc4421a14cb2c44911720ed12205d912

SHA256
bc6ad2d53a76a09c2b6ca900db006e40e6cf44a7e5b2a335ea35d404013b43e1

SHA512
1a8410fe26806b6fcb1d91cd5d5c7bfc36df6d051a40eef49330c979d1fb3a66e5f830364cddcf69fbb04926c016379ee79c88abc68435a2bced3626b1dbe7aa

Download Submit
/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_webview/Web Data-journal

Filesize
1KB

MD5
58129c32c27b0019370e5937684b2de1

SHA1
c7d4ff760d3fcfccdbf0b0782215be4bef7fcfb5

SHA256
6cf4d873c0f4728bbe7783ff8d3d7123ebc761fe3f10024ee23b37220909a5b1

SHA512
60b3f7914be3a3f13995d590b142a29a60dee245505234927e7cc3e084008a1f6d5969e1ae24865b2faa9d4c38e760bd6c1a61c994963fc5d90b40cf1f605ea4

Download Submit
/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_webview/metrics_guid

Filesize
36B

MD5
7da119de708e6a9993849191634d8c23

SHA1
6ff941e2a9d02d40230c21d479506d8f89538d31

SHA256
50ee494a3e8c4fa84c08597f881564b04fcdede8308dd4cb6cd441e6fe7a7dbe

SHA512
b57d3f300a56e47885e433163a8cc8c6f9e4369224ccc281ca0a7b95fe4fa1ae5c945e2d299b86a6c3bfd94019d610f916c892430240c64ad22f108fadd47439

Download Submit
/data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit