alienbot | 559fc04862c2cceac7adeb41328971978dd9b34a69f77bc1f2a7b56577e58bb2

General

Target

559fc04862c2cceac7adeb41328971978dd9b34a69f77bc1f2a7b56577e58bb2.apk
Size

2.0MB
MD5

3b8ae394a9cca08c46e8b5acc6586a00
SHA1

e7aa1d821937d722574432410fb235fccba22965
SHA256

559fc04862c2cceac7adeb41328971978dd9b34a69f77bc1f2a7b56577e58bb2
SHA512

1a5f632cab2283e3d076cb882c25ae37c004e95e8ec81dd159f20ea872968d273dd95378ad823aa457f8a58f626eaed691c92a2c216e8f804f64cfe5d7491fd2

Score

10^/10

alienbot banker infostealer trojan

Malware Config

Extracted

Family

alienbot

C2

http://scenteadid.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/YmtXQl.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/oat/x86/YmtXQl.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/YmtXQl.json	5062	kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs
/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/YmtXQl.json	5107	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/YmtXQl.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/oat/x86/YmtXQl.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/YmtXQl.json	5062	kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs

kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5062
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/YmtXQl.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/oat/x86/YmtXQl.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5107

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/YmtXQl.json

Filesize
683KB

MD5
e6a735de937330a6d9677b48c6ec2d0d

SHA1
2a192502ea568691a7f52366d85f4e905dc97210

SHA256
ab4d1548deebdf25fc2acd67814289cd7b37bff4201b4803a686cf5c0aa06652

SHA512
a7cf4a0d4d2a44a0986a72b6c0c82c323b24190ad988bc08e6da9b3a629125a4d0283589a9e5aa4528a89f832bb76728b56d47342977a37d5fed706c921f0412

Download Submit
/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/YmtXQl.json

Filesize
683KB

MD5
7b83ad1f5e7f40d94f2a227f29ae4e2b

SHA1
91d3b791dcf6b3e2906bc3f2037fb02fbdc95008

SHA256
57be37d122fc62d820075ed64d75a732a64260783882d221321c54f10276543c

SHA512
a388a399474611c79d2a672587586a6ea2aebe14a49c786a3a3a052c7ad3a5566cb7a45da0b9f9ce8b795daef175a1cfdc6ff5498c4e9e95c87cc74233a14687

Download Submit
/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/YmtXQl.json

Filesize
683KB

MD5
49511751469b86fcaac06a32d98104ed

SHA1
f468af229a53efe9745edf58d3e8f9af42f0abfa

SHA256
d63678fef482b13099793836b04b60c15368297e49dc5148156fa42a96605070

SHA512
ec6f11a138ddeb02472a81a3b0eeeec10e37959705cd47d856b5b87d799c2ebf0ac1d7224155c867af2e6b63bc37a1b7d1ab5d155a775e386f58d40dab371527

Download Submit
/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/YmtXQl.json

Filesize
683KB

MD5
7b83ad1f5e7f40d94f2a227f29ae4e2b

SHA1
91d3b791dcf6b3e2906bc3f2037fb02fbdc95008

SHA256
57be37d122fc62d820075ed64d75a732a64260783882d221321c54f10276543c

SHA512
a388a399474611c79d2a672587586a6ea2aebe14a49c786a3a3a052c7ad3a5566cb7a45da0b9f9ce8b795daef175a1cfdc6ff5498c4e9e95c87cc74233a14687

Download Submit
/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/YmtXQl.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/oat/YmtXQl.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/oat/x86/YmtXQl.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/oat/x86/YmtXQl.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing