alienbot | 2146e26d07866ea59ff5cd7929e0a0a9ecd9f4b7c36cc17355526420cf3ae96c

Analysis

max time kernel
3874803s
max time network
150s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
21-05-2022 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2146e26d07866ea59ff5cd7929e0a0a9ecd9f4b7c36cc17355526420cf3ae96c.apk
Size

2.0MB
MD5

49ea02357e6f6f028e44711a1d10da19
SHA1

05935f542d17cf0902b4b81c67464214403ede9b
SHA256

2146e26d07866ea59ff5cd7929e0a0a9ecd9f4b7c36cc17355526420cf3ae96c
SHA512

03b6fedab94ef69c92f9923b5e939aaaf26acd123686ed7bdc30f6fe23830064f69293c06bf7b6053fa82e11cc05e4ce9c617375108a68b714b9b2b5f5b90f98

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://mmkigvfe.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/CwUift.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/oat/x86/CwUift.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/CwUift.json	5034	rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/CwUift.json	5064	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/CwUift.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/oat/x86/CwUift.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/CwUift.json	5034	rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx

Removes a system notification. 1 IoCs

evasion

Processes:

rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx

rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5034
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/CwUift.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/oat/x86/CwUift.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/CwUift.json

Filesize
704KB

MD5
4151a9fbd21a99a1fbc552751fd5ba33

SHA1
67f9ebe64e96cb74a364290ada35f8ff8f9fb21f

SHA256
4e42d099937f389640ee13d3c13a0fa3cf2c771ad90bb08f378d861735657c01

SHA512
007ce02967c134e66796d3d2d87d363b2d31bcb3e861905cb38efb1b88a082ddd50a261233f831ac04fbb648f0cfe716e7137cdb8fe9bbcaf1774287a709bbe3

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/CwUift.json

Filesize
704KB

MD5
6303290e3f0e537e3e293e5300a9a9c1

SHA1
ead039c623b01369b9f49f1055e41d128675a326

SHA256
dd6a779f33b56a1321075d7de314153a5f59b10d4bd90d31bea83e610b3fbe8a

SHA512
4aa428d912c7dc518ba6da267d107a18c4d594e225a533e5068c23510719abd76ec4d8892b520ff276193646033ffdf1702db5d8ac9926fdf85d4ea3d427cace

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/CwUift.json

Filesize
704KB

MD5
1298b1f9760ece59925a6fad6a25cd93

SHA1
a9c7f1a37d5b8884561191720d3b535cb1a8543c

SHA256
874764ae7530952c5157555d19791f76d0b5270392a146aba3937de44b12bf26

SHA512
f66288372432df3857e5dbe9807667a918ad7219382259a88eead8d5ad6ddbb9c6bd6825ca27bb4323b4fbf951a5b6be7521bfb78d54765cbf77fb4e4c140660

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/CwUift.json

Filesize
704KB

MD5
6303290e3f0e537e3e293e5300a9a9c1

SHA1
ead039c623b01369b9f49f1055e41d128675a326

SHA256
dd6a779f33b56a1321075d7de314153a5f59b10d4bd90d31bea83e610b3fbe8a

SHA512
4aa428d912c7dc518ba6da267d107a18c4d594e225a533e5068c23510719abd76ec4d8892b520ff276193646033ffdf1702db5d8ac9926fdf85d4ea3d427cace

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/CwUift.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/oat/CwUift.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/oat/x86/CwUift.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_DynamicOptDex/oat/x86/CwUift.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
67bd5bc3b62688cde92bb73f50e16662

SHA1
20138aef3cbf16b8a79adafafc14b502da9385aa

SHA256
103e1371a59bb698d4ae0a358cd9150460c27ccb347902576078076394d175c2

SHA512
43c97bc4f682c7b0bd3861c9c789a990ffecee522040feb2d42c9bbb0311f91c8718ba9ade8dc667dbf8f3ef36d8d4aaed823223dbbe97d31743b85216781868

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_webview/Web Data-journal

Filesize
1KB

MD5
f278ebb6de0e824561c8e4995c6b2b35

SHA1
fac3f7c2619c149ec41f0ba8586efd381a7d8595

SHA256
c18b07f0b1d37357f175005ef759ad256d5702b34ad0c2904e5994d2b906ea08

SHA512
2ab4fef88bb804a1fd94b5c6bd75d21a9828b09a9cf5de873efd91564f802a0a0775f7411ffe8684432c24d58ab970aecaa102ce6c044d5e38fc4271a4359ac1

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_webview/metrics_guid

Filesize
36B

MD5
e904a39090047ce4f5e592b1554d1792

SHA1
e56ef7f2c90e78cc378a866539ce4e97dc462f9c

SHA256
e7ce2244427a2e3caa48d41a17703cbd2ee3221348709fbcfd6cec40f8462dec

SHA512
537b4ad2f13f39c870008aafa07919549ed68fb8a932ba08755721a0fffacd63ed0cf16c99336929bd7ad9f2159ec8e8b96ab014edc453abcdc05b2a023f63f5

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rqkkrgwjmtbjsdzxifpg.hcrzafbtlmpi.mddkqetmgajlqrkgyfhx/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit