alienbot | 212bdaccf3bb834508f9be5fba58711c6407d4697577e3e3df8e0d37ac7d86ff

Analysis

max time kernel
3871262s
max time network
157s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
21/05/2022, 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

212bdaccf3bb834508f9be5fba58711c6407d4697577e3e3df8e0d37ac7d86ff.apk
Size

2.1MB
MD5

94f80ef8636c50c1293e70ba0f868585
SHA1

a9ffb027facf7e2019e6c7d552e2c3c6926f7527
SHA256

212bdaccf3bb834508f9be5fba58711c6407d4697577e3e3df8e0d37ac7d86ff
SHA512

519ab3643d693e1bfc0249ab5e0b31c0c2b52503996db885fb9ba8d5765af976ac9ff7734a247cfa3c6aa5214b9968ecedb6630a2e207ef4e78f4a00bb658c2a

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://newgenerationn.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_DynamicOptDex/ihXK.json	5298	ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq
/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_DynamicOptDex/ihXK.json	5328	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_DynamicOptDex/ihXK.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_DynamicOptDex/oat/x86/ihXK.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_DynamicOptDex/ihXK.json	5298	ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq

ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5298
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_DynamicOptDex/ihXK.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_DynamicOptDex/oat/x86/ihXK.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_DynamicOptDex/ihXK.json

Filesize
668KB

MD5
d66efc328987c70e84f3ada25ee36ef6

SHA1
8863e88ab55a4d511b507d5bb6be80847ad49459

SHA256
832d66ea95de17c8cc39c5f031c273c0567cd9e67c63c7a4c58deb1bd00e223a

SHA512
470f9d86c6721aaaaec9b7cdf35a190d92cdef710a76209db28a6ad60b9758256535945e30952f7f5c04111d1e7af857eecd15b942ce37bdcea85b17b14b97c9

Download Submit
/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_DynamicOptDex/ihXK.json

Filesize
668KB

MD5
54922ece1f40b23d1647c192891b960a

SHA1
06043bc7c5f395d8aa8fcf7a7f79d5e54f5a76b2

SHA256
da8de8c71cccbf443a06cc7bf45981eb1435790829b63a84e84cf9cc0c01fc6f

SHA512
d581810e9f04b9ce5d6c9f517e20f36c3be4520a1b8cbeb5dae8c4e4810a629ff4a88feb0065945f9152a5fc261cbdd3563b7e8a40854de230078a84bcbbeb82

Download Submit
/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_DynamicOptDex/ihXK.json

Filesize
668KB

MD5
a718746d5a6fd965bbe818f6734dc137

SHA1
1468aebfcad544da9d969814acec1ca0eae04e1f

SHA256
9e1c0ab715c9cf1b23a40b8a52e31f4e0304ec336929e45670a4bac33fe3cf87

SHA512
e90278eec7dee87c38a279edf14928fb2cff635959afb8a6f0439a89cba6a630219c1adc4067387aa214c1dc7e0b202cccad017ee2a6d5c33a61d71c7ec97b86

Download Submit
/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_DynamicOptDex/ihXK.json

Filesize
668KB

MD5
54922ece1f40b23d1647c192891b960a

SHA1
06043bc7c5f395d8aa8fcf7a7f79d5e54f5a76b2

SHA256
da8de8c71cccbf443a06cc7bf45981eb1435790829b63a84e84cf9cc0c01fc6f

SHA512
d581810e9f04b9ce5d6c9f517e20f36c3be4520a1b8cbeb5dae8c4e4810a629ff4a88feb0065945f9152a5fc261cbdd3563b7e8a40854de230078a84bcbbeb82

Download Submit
/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
b39ee4b21a83b5f2f59b841b13f6c089

SHA1
e7dbcbd9ed54856551e475ca8b3a29f516a2fb00

SHA256
5ef43d2f17ff1ce6e3e9d6072b0bdc06f5b5924a26ec2f2fafda69741bbe4955

SHA512
15e476dd004d17874d232800df5a3c01ef306046dd2148d4611b81a2747d09d8ae771217c9f6becb14425de1c4de963174fc0abaa483638dd1d6c4c81e661140

Download Submit
/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_webview/Web Data-journal

Filesize
1KB

MD5
a7e19f79d0cad4542d7230cd98878474

SHA1
7e87e475206c349a79109737e9c5239afcf6b2ba

SHA256
cd8e0ec06e0c7ab9a9bf4035655323de8415c9b0732f7eea60f2edb5719d30e5

SHA512
a23e6e7043a7b13fae26be35790f300f9815b8d7af88576baa6765655df695815a5bb3d3efa391fcff287619c59ea53361262426a81de4c8399d470b3bc96938

Download Submit
/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/app_webview/metrics_guid

Filesize
36B

MD5
78b027c89de56e36197ebfd6dc60b566

SHA1
d1177dc74edae64b62731a6581170066f2d4ef54

SHA256
5969e2c3943333f896452bb3dd24cbfa5b1d891c0853a1144972084e95385de7

SHA512
84203cb4603364e3f76f0a9e9a4573ad973afffbe5142e7644909e55813e5e19e0b9836be8de0cac4f4652d3ed1257bed8e720d5190ade9b1863b6dbe2c482da

Download Submit
/data/user/0/ixfgqkhnmndlxcsnrqya.ytuyiuihouclgcsmnwid.dglyukq/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit