alienbot | 64845311c2e7ae9d027175b4b1443d9e039b97aeb1488785935dfe037ad884bd

Analysis

max time kernel
3847773s
max time network
154s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
21-05-2022 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64845311c2e7ae9d027175b4b1443d9e039b97aeb1488785935dfe037ad884bd.apk
Size

2.3MB
MD5

fb9cfbcb8f613960e091d03f62e52078
SHA1

8002498665d45758aa057bef17f91d23ca5d8df8
SHA256

64845311c2e7ae9d027175b4b1443d9e039b97aeb1488785935dfe037ad884bd
SHA512

aaa7365373909a1765f97bcc154db6d273085f44c61e46a487246d21d952c0d3f94dc5182becaedffb138c05918240a2aef5d9e202c74451e00255de5e72a97d

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://cxmarcellsat.top

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/uM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/oat/x86/uM.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/uM.json	5033	kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/uM.json	5083	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/uM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/oat/x86/uM.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/uM.json	5033	kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu

Removes a system notification. 1 IoCs

evasion

Processes:

kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu

kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5033
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/uM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/oat/x86/uM.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5083

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/oat/uM.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/oat/x86/uM.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/oat/x86/uM.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/uM.json

Filesize
726KB

MD5
723dbe59e6ed87beec8e3b9c96c68e0a

SHA1
079fb9db6b9c7393918300a7afcc6cfca684ebe9

SHA256
efd9aaa0e4a79ca3f9293cde54d928e052031db7689614571bcfd169ed45eb3d

SHA512
dc3feedbbb9cf8305bb2eebfba96267203cd13556b570501d46f010e784a9a9385902fe8e20112587a81403d0b2672cacfc27ba79c11741c98036ef3b7d30458

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/uM.json

Filesize
726KB

MD5
9d13bcce32673c487e2e0f18f99e7537

SHA1
166387b50ba791dceadffde3761b71a25a4ffc3a

SHA256
8dc68892fab2c7422413f3a313c198ca7e1f30a8ee8ad469b3a41ab39311798d

SHA512
89a900fc9946fe63ff117dfef8dda464ca6f86eb05f0c9a2dcc120623068de06b2475dd5630f6acce3ff30256ad9b7c0818119d9bef27554570b3287834ce000

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/uM.json

Filesize
726KB

MD5
7779e1f20a02437468e74f0731e89a55

SHA1
ce676a7f1ff61b16f95d9214ed0aa504f989e474

SHA256
e0cb0008575c55a9cc19f784772255930a9544a289a3c42700714181e4993617

SHA512
fed41562251303d1bcb3810411fd663131cda1d86de0d4f29f4abb8978e4553e2c27c16624921a09f26a4693597fbcfed5185829ca0f079fccf67dca5bced045

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/uM.json

Filesize
726KB

MD5
9d13bcce32673c487e2e0f18f99e7537

SHA1
166387b50ba791dceadffde3761b71a25a4ffc3a

SHA256
8dc68892fab2c7422413f3a313c198ca7e1f30a8ee8ad469b3a41ab39311798d

SHA512
89a900fc9946fe63ff117dfef8dda464ca6f86eb05f0c9a2dcc120623068de06b2475dd5630f6acce3ff30256ad9b7c0818119d9bef27554570b3287834ce000

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/uM.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
bb179cb18ae77d196d05e83772b6f28d

SHA1
07c3f9480797a992c3aaef9ee5162f03acceeaf3

SHA256
367261ece01b4856eac02ac56e35a0dec49042fb241fd64dad04ed5d67c703ef

SHA512
431a6bd3e1a09248f2aa3abf4bf870251883aa886d02b54b400fd36030c13c896188a6e7ee4d3cb93262bf9adb3c91bd2dd238b4a4442e4c19ecbe25129665f5

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_webview/Web Data-journal

Filesize
1KB

MD5
af58c125de2fa6149de630ea7600714e

SHA1
d6a1ed2b56eb598e34c4b210528434e45310d6cf

SHA256
a2fe9e5a651ead7f0c8338f370eb799b2f54343de77379a565a5c7c4cc27e895

SHA512
1d48d4ab4fa9b8990eb12de2dce9baa141de886bd2805b7fac415cad63ab0851eac40e8c5429e1262ef8ec9db582543f7c892ae0b15698bdaeee7249c95ef8f1

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_webview/metrics_guid

Filesize
36B

MD5
5775bd5e30db37d34723d7534503fa46

SHA1
40cf3c2d286d5888afd2a58ab382bd171f486d92

SHA256
0448b4504a00bbff56e8eec4a71fec545d1412d215ad44ffe01712c1f8d4198d

SHA512
b9b0227b4c5c8c6472724004199c127565012d015242be0b69a0917d87efa4e02007146c2dae376575e0598e2d809504ee5a3c2c2041f3d600ae9141ff7ae72f

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit