alienbot | a8f523a87a256f37024a21e649ae249b268a1c7a8c2dc8039fe12f1176d5c407

Analysis

max time kernel
3847790s
max time network
154s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
21/05/2022, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8f523a87a256f37024a21e649ae249b268a1c7a8c2dc8039fe12f1176d5c407.apk
Size

1.9MB
MD5

7c1cc8dab40e4ccdc5b1e39c7f21b488
SHA1

8e24be698fe715a9e488a1cc8741b0bfb9bd4ff7
SHA256

a8f523a87a256f37024a21e649ae249b268a1c7a8c2dc8039fe12f1176d5c407
SHA512

b4d497dd039f4ed8e605b468e23ed742949c7950e6c2c9e8fe888770b492d0b2b91fcc9735478c6151ff90288a8573f5360e1238200b99dccfb4f0c54b91f3f3

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://anycastedprivacd.top

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_DynamicOptDex/LkQ.json	5038	ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm
/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_DynamicOptDex/LkQ.json	5069	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_DynamicOptDex/LkQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_DynamicOptDex/oat/x86/LkQ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_DynamicOptDex/LkQ.json	5038	ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm

ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5038
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_DynamicOptDex/LkQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_DynamicOptDex/oat/x86/LkQ.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5069

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_DynamicOptDex/LkQ.json

Filesize
706KB

MD5
fd33868c6b381eae4369fa17d35fbdce

SHA1
da4b083fc86011d230012451321478685bc2b0dd

SHA256
04099eed234f209108585df56db7f9f755cc434ba8e1a57c332658c7fc00f70a

SHA512
e9136c0e0f51ee1ff4a31769c33c827b86578a57315aa302c17fa633a3f723fb1c2b11eb7a4f539e55a5f12be1669c7bbdcdba825b892d7875088a1c3ca1a3cf

Download Submit
/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_DynamicOptDex/LkQ.json

Filesize
706KB

MD5
38f98bd63dba5d7813f50886b3fcea24

SHA1
70a32544c388477e1bbfd3b8519ba2583b9bfb22

SHA256
84c134d08691de69300aca697bc8af73725085eaae7024847c269c03e59f7e99

SHA512
9d3630019812a2b86df47b018cce6e0c1efcafc52a0f824fa328e30d33a6589d74a266c00f39662972f2a3e38315c6312d962ffb3aff49a78686a626406f2ae4

Download Submit
/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_DynamicOptDex/LkQ.json

Filesize
706KB

MD5
8f2064a087b71af352f6b22ccd2c93bc

SHA1
f56b64ea0c50a4296e0f8cf2396a97ed00448a24

SHA256
7b241b92c89a03af498a0a93b6de4d762d6c3b90f05be1f4363210d74c7e7c50

SHA512
5f4c00d14d7e278f07979ba3fcc7e96b20488c7ff50e7a884833f96fee9d49eb9fe40154ab4882092b61d7c5db8e1431b533b7beec400524f37075488440bc00

Download Submit
/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_DynamicOptDex/LkQ.json

Filesize
706KB

MD5
38f98bd63dba5d7813f50886b3fcea24

SHA1
70a32544c388477e1bbfd3b8519ba2583b9bfb22

SHA256
84c134d08691de69300aca697bc8af73725085eaae7024847c269c03e59f7e99

SHA512
9d3630019812a2b86df47b018cce6e0c1efcafc52a0f824fa328e30d33a6589d74a266c00f39662972f2a3e38315c6312d962ffb3aff49a78686a626406f2ae4

Download Submit
/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
d245c18a65f80a03f8d8ffc7a2991ecc

SHA1
352faac30ad0ed81cd9c8a5024c7d69eb1268d3f

SHA256
eb8edabc08f80d167299192ab46ef338f3dc0d47c9636177f2eb567ded7d7e0a

SHA512
22b4103f34ce5b0fcace91e213479b704e1fc31e501651f5860caf97166e1622664bea3e4d17ebf092a618f2db41eb20f002e6ff58105e2d1ce7cbf753a47e66

Download Submit
/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_webview/Web Data-journal

Filesize
1KB

MD5
34685e78f00cd7fff7cc385962231de4

SHA1
ad55bda5e05e56c9d0a510d281f533308a9958e5

SHA256
5d541c8c8cd269e13601030064b9e8ba129820ea1101bc0d6ff404e9f55f1a65

SHA512
377608d87882505eb5305ea81df12d5a234a35235aceec1a9780eb4c582134a6e0f3fbcbb0cdbf17e0cce6cd3e94c2ee18cdb991c4ccffcbf9905afed2eec76f

Download Submit
/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/app_webview/metrics_guid

Filesize
36B

MD5
14a54058432291b86bd9d02bd6a9a362

SHA1
1f456930147da1b6417a86cb292a5109b8b0ebc1

SHA256
486a606798732dcde67239039db7fe0c7fe01ada33e5c71f41ec4730edf15d3f

SHA512
0774ba7278d9773636b7c2074d840270f5bf00d46a4a9503069bbd56ef5377d4afab17283469a9cae530dbd0ce52576cffcdaf2f6da7bb17e7c07579f51c0f0e

Download Submit
/data/user/0/ajbyekerlpgckplfycmmjrk.fenbiyftnmcheehorjpsi.kmgdjuiuqijdumlflrqhgnmm/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit