alienbot | 66427521c50cd888548749f8527a3b503e9f381e49715a8c6d080689f22f3ad9

Analysis

max time kernel
3869256s
max time network
132s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
21-05-2022 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66427521c50cd888548749f8527a3b503e9f381e49715a8c6d080689f22f3ad9.apk
Size

1.5MB
MD5

26628cea0f6730e49a1e527a7354d41f
SHA1

78270866aeb9e03a2b7564da3101af46d46762cd
SHA256

66427521c50cd888548749f8527a3b503e9f381e49715a8c6d080689f22f3ad9
SHA512

631cb3afddf13be8aefcb485ececaea1212ef82add7f7f3db8f17e00e584f6adde56df88b28da2e6720d1ea437b40c27b99c01ff66c00beb8b01606c758a5edb

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://tambuland7.live

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

hdbewfklmnbupkor.gexnuu.qegmbshdlpx

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hdbewfklmnbupkor.gexnuu.qegmbshdlpx
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	hdbewfklmnbupkor.gexnuu.qegmbshdlpx

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

hdbewfklmnbupkor.gexnuu.qegmbshdlpx/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/nTjD.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/oat/x86/nTjD.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/nTjD.json	5084	hdbewfklmnbupkor.gexnuu.qegmbshdlpx
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/nTjD.json	5133	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/nTjD.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/oat/x86/nTjD.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/nTjD.json	5084	hdbewfklmnbupkor.gexnuu.qegmbshdlpx

Removes a system notification. 1 IoCs
evasion

Processes:

hdbewfklmnbupkor.gexnuu.qegmbshdlpx

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag hdbewfklmnbupkor.gexnuu.qegmbshdlpx

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	hdbewfklmnbupkor.gexnuu.qegmbshdlpx

hdbewfklmnbupkor.gexnuu.qegmbshdlpx
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5084

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/nTjD.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/oat/x86/nTjD.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:5133

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/nTjD.json
Filesize
671KB

MD5
caabb43b6f2127de8425850a9cf3c992

SHA1
4e979a9f04b6bcfcaca071616146b320255cc34e

SHA256
67bc37495b5aa40dfe310ec165f24d467373daf1726c933e0c346715a6e2053e

SHA512
b4bf1da56a542421a47e6c3fb5184c55bec6b968311d73cfd78cdf5c2ca431120bfe69ff06f69e51bef1e306ebd7b9655ab64676c65f48b6e27febfe6d097f7e

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/nTjD.json
Filesize
671KB

MD5
587899929d868a50d5c9e01aebdeb2e0

SHA1
2a4ec41d653cb6700f8c84042f2d629538b1e34f

SHA256
ffaf2f963674cb5214e46d6b2ae33497d4149d846ebdcfd2fa2551189e477ad2

SHA512
85cd3334935ec9bc25c7d839bf5f4dcfb0281ce8a71e6cb35a64b4d31594e28308cd5979f8d2ba39abfb6910038df19fbeb6c5a9157872a597816b8a6fafb8b1

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/nTjD.json
Filesize
671KB

MD5
7edad13f4b9893cc713c2459e26df3fd

SHA1
9fba45bf1b07a09d6f663b2e741b54744a1ab911

SHA256
8cf593afbe2a5e4d8c96543f7a9e28732ee8f76501aff9339befcb71f390d03c

SHA512
06f6dcfa0e31691a743798b00235eb0ed30710e793fbb6c8a0e5d957ddfc8ee9d059e30a21b7753beeced601661c2b3e72af0dc85005b4493a22a58202ef4694

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/nTjD.json
Filesize
671KB

MD5
587899929d868a50d5c9e01aebdeb2e0

SHA1
2a4ec41d653cb6700f8c84042f2d629538b1e34f

SHA256
ffaf2f963674cb5214e46d6b2ae33497d4149d846ebdcfd2fa2551189e477ad2

SHA512
85cd3334935ec9bc25c7d839bf5f4dcfb0281ce8a71e6cb35a64b4d31594e28308cd5979f8d2ba39abfb6910038df19fbeb6c5a9157872a597816b8a6fafb8b1

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/nTjD.json.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/oat/nTjD.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/oat/x86/nTjD.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_DynamicOptDex/oat/x86/nTjD.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_webview/GPUCache/index
Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_webview/GPUCache/index-dir/temp-index
Filesize
48B

MD5
c202a9546c4b4ec858cf9d57a7d5fea6

SHA1
b5180a16ef7d6808943b6e4991b404c63dd9b988

SHA256
744b55d19b2b3ce8a9da81af9cd691b0f8b9b9168020752898d8b4b1d223b8dd

SHA512
5b1348a87a7d778c6603c812bb49ac2172a8ae60d0184a8bd1fd18dcd00d39bbd66867b98e3343fd8c09111d1a22fa1873a656511ab7736b6b9756bf78c98b2d

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_webview/Web Data
Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_webview/Web Data-journal
Filesize
1KB

MD5
423e19d1191a97143a558f9f0e1e9cb2

SHA1
1a568e698f4f9ed7af8e0266f0b343b273a63dfd

SHA256
df67f8c359f933ee3644721d72062365498e1bf92725f83e2dee2de747a1cc87

SHA512
f662b15eb3de81d750507cf076475a9fde719d35776ed12b049fd5f6b43fb1dab3b33bff5e5d45c9801bd395ee99aa8d8b253b1960aa2a6963e5b518d0b0e417

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_webview/metrics_guid
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_webview/metrics_guid
Filesize
36B

MD5
d3dfbb2dc22bd248f811bd8aa2cb83e6

SHA1
2b7f724bd3c00991fbde1b74ccedaab0509c0368

SHA256
a8504a1e8e52b2804b3194ddb12c407e8617edc7ac09871d9e30099ed333fefb

SHA512
d6801342e5e639e6707d9128d90fc7e05a7d760cbad3d6c6fa3a155e0f53aeb22f3027626463e5f2a27784bbd8db020abab7cc7f3943d87fdda2b6a63668d5d7

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/app_webview/webview_data.lock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/hdbewfklmnbupkor.gexnuu.qegmbshdlpx/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit