alienbot | 477e5d17a0065cc5fb5fd03d4cc867c6c552bb5f221f7aa2178414b9e5a86631

Analysis

max time kernel
3869187s
max time network
154s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
21/05/2022, 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

477e5d17a0065cc5fb5fd03d4cc867c6c552bb5f221f7aa2178414b9e5a86631.apk
Size

2.0MB
MD5

4d740e1be49691ba85ea6bc864758b19
SHA1

fa4a22a59574f1e5d13a0b04283309625af0f9a0
SHA256

477e5d17a0065cc5fb5fd03d4cc867c6c552bb5f221f7aa2178414b9e5a86631
SHA512

5ec2103d83f8e9ce1f28897ab58a1b26e429060ac836e6f5827e68fd39b73bed9b075dc6ce709aeddeba1b1aae4ec5117b4fb676a6f380ed3d799d2f262ec5ac

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://postkod.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ylj.oerdpcf.nmrezdkuxnopyljfasnk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	ylj.oerdpcf.nmrezdkuxnopyljfasnk

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_DynamicOptDex/XDrQfaQ.json	5300	ylj.oerdpcf.nmrezdkuxnopyljfasnk
/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_DynamicOptDex/XDrQfaQ.json	5333	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_DynamicOptDex/XDrQfaQ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_DynamicOptDex/oat/x86/XDrQfaQ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_DynamicOptDex/XDrQfaQ.json	5300	ylj.oerdpcf.nmrezdkuxnopyljfasnk

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	ylj.oerdpcf.nmrezdkuxnopyljfasnk

ylj.oerdpcf.nmrezdkuxnopyljfasnk
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5300
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_DynamicOptDex/XDrQfaQ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_DynamicOptDex/oat/x86/XDrQfaQ.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5333

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_DynamicOptDex/XDrQfaQ.json

Filesize
676KB

MD5
43f3fae1d21cd84b051f6a439a6fcab7

SHA1
db18cca6fa98c63399616482efac12bbd1747136

SHA256
99a174b72271807140247b555e7fe36f167bbc67daeeabb4b6d65c7a62efb725

SHA512
0de64a181191f77fe6f4deacfc2f403884bee94a6e3c4a4f9de008bb5544b87e580ec5236377b080e4c9c800bd5fa602cbf92069c13ee6775234c1e1267e1069

Download Submit
/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_DynamicOptDex/XDrQfaQ.json

Filesize
676KB

MD5
f18911197816660007608b08b52461bb

SHA1
21821c2f1a2a84ecfe063c682b0372eb657430bf

SHA256
7bd6c223daad37bf3bc8b9dde54c33ce79d3d94e11cfd40528543650112cf3aa

SHA512
c2f635b915eac0bdc289274a0066d701fd49c371e8c87248fd1973baacccd8d32041fe55ec28fb44535409ffd9fc08603403e054fdfce3dc741c9ed9f37e4690

Download Submit
/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_DynamicOptDex/XDrQfaQ.json

Filesize
676KB

MD5
99abc300f4256f0917c0c9d05ff5175a

SHA1
71aafc82bc2ce82c70edbd15a90a8597c01d4bf4

SHA256
46541a5d7c161f78b5ffec0978c278882ec2a7a28840db098c418af0c758d42b

SHA512
cb8cc77a0ca5f2083ce4847082eeb41f1829baa3385da97c022117c8eddaa677ed64d8767451a8a9eab75e15de508671a8e564b8fad21095bf4198cf9ec97d27

Download Submit
/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_DynamicOptDex/XDrQfaQ.json

Filesize
676KB

MD5
f18911197816660007608b08b52461bb

SHA1
21821c2f1a2a84ecfe063c682b0372eb657430bf

SHA256
7bd6c223daad37bf3bc8b9dde54c33ce79d3d94e11cfd40528543650112cf3aa

SHA512
c2f635b915eac0bdc289274a0066d701fd49c371e8c87248fd1973baacccd8d32041fe55ec28fb44535409ffd9fc08603403e054fdfce3dc741c9ed9f37e4690

Download Submit
/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
fe143497ea2350768a763053eb21c8fe

SHA1
201a4f3a38d52fa685fc5465207ac90bea5682ed

SHA256
f12e7c932801e8b865eac801fe7dfaa9042416ca3269e8e9d35fb96800cc580f

SHA512
59a11d3857c851f2f5c449d02da3e7cb906eb7564ee222f539655e4d5d7b05fa311f168efe8e5e7b3c61854c1ae8a203b1207c231fbdcc3231d0fb762e502f6c

Download Submit
/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
f3c588ea0c46e7312188f4b70bf6cceb

SHA1
abb63131d2297081648d4e37eaabcebd2d5f08e4

SHA256
ce9f0af981c8e1dfc708bc73212e64623f203168e33525f1ec29fbbe5469a71c

SHA512
c461f0df1cf60dcd0bafa40ccb8e207361851468d98179a1b4c7fb5271a1d077e1528bd96c23991975c654d6f6cdc6acaeb8081e7ce29fab1108a99b9fe1a76e

Download Submit
/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_webview/Web Data-journal

Filesize
1KB

MD5
1a25721964e5ebc0b722e2d71f38f396

SHA1
982b985d07ba4ea527a42b4b82cf750803393992

SHA256
f0f2183dccee1042e0ae731c5980b67786e857a2b0c15380e96ba80320fc15a9

SHA512
e599906eccfea449c3fc26f96be8c8cb7d5eab7580c1424acccc1ad199926ebb623f91601a1f837988dfeae1c7d5019cafa8fdaa4fd6621741820a0e54ccaa8f

Download Submit
/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/app_webview/metrics_guid

Filesize
36B

MD5
498e1ec987d72aa32df85d3fe4c4a8a9

SHA1
6f7757b507019b660424e0dfd3b3a9c0acdef128

SHA256
70588f5c31f83dcaea02a2affe6d4ecbcd46d9dc7f0d2757e9d4a1ed635255fd

SHA512
aedb794208ff750f476006dac055540f3621ea71b929c2ec4fcda6b8e635eb00a899303c16b806e2ba92ea1a66522ff1c2dfb7fd1c23090f367c0fad24f183d9

Download Submit
/data/user/0/ylj.oerdpcf.nmrezdkuxnopyljfasnk/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit