alienbot | f11aa442642b1d21abc624121358a2e8206cb5c46d0fdb473450b045d3b77956

Analysis

max time kernel
3872896s
max time network
146s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
21-05-2022 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f11aa442642b1d21abc624121358a2e8206cb5c46d0fdb473450b045d3b77956.apk
Size

1.8MB
MD5

1af531ab2146d62a2d7ade0b9598e04b
SHA1

0123fb13995de05085fabf7306f69e573d02cd3c
SHA256

f11aa442642b1d21abc624121358a2e8206cb5c46d0fdb473450b045d3b77956
SHA512

7b928f122e2ddc84f0fa2a2bde06ad21dd5689320544d7d5a8193698affa95d1f0054d557226dd91e31b3dd23b063453c8027ad25b87ed82bd1cf457c730cbd3

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://installerflas678352.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/RENYQEO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/oat/x86/RENYQEO.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/RENYQEO.json	5140	eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/RENYQEO.json	5187	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/RENYQEO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/oat/x86/RENYQEO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/RENYQEO.json	5140	eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef

Removes a system notification. 1 IoCs

evasion

Processes:

eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef

eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5140
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/RENYQEO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/oat/x86/RENYQEO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5187

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/RENYQEO.json

Filesize
731KB

MD5
2b6dc028a35e3f1df5e0a758c393c342

SHA1
e698494e8f4a1a58b7d761687c1f5a6a847dfcc6

SHA256
8f9bd021c54565581f56134a86543b841305438b4ab612e27a252c42961577bc

SHA512
c2481175b72f476dba63b3e08432b6dfe322804cfe99ecfe7ea4e4cde39244a2861ec7fc2588906ea1b7ed49132f296d32cbeffd3fce77d80f047193a42a7c73

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/RENYQEO.json

Filesize
731KB

MD5
044cf8823dfdd7c530563a9e902baa99

SHA1
4e95cadd9965024a0b80c4e8e96563e914512eed

SHA256
23f01c2fbb5cee82d9af62ddd35f12129575b79a17b129c4f6d19218c20840f6

SHA512
a5239c092c0ad1191a17bcceac2ef322635ba441e28643b7e00192254d3eee6c9b0bb5f5c5a3b3d09b60a467bb996d63ff69e63fb7509511409e82cd3813bf98

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/RENYQEO.json

Filesize
731KB

MD5
9ba42fc964cabf866f6b27f1ba854435

SHA1
627ee7ecc56baebe28ae839d52f34fedf03e7830

SHA256
668d11954b3f391130f2bc99f968f1b372351cb46a3d9f2d70ba660ee78eef80

SHA512
c38fe3cbf3ade479f035fb0b9406e810fad8ca394ea78fc51cad657f5681f62d5fc381b41c34af8a63af777a988eec660c9542991d05de7e544f8480bd2de709

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/RENYQEO.json

Filesize
731KB

MD5
044cf8823dfdd7c530563a9e902baa99

SHA1
4e95cadd9965024a0b80c4e8e96563e914512eed

SHA256
23f01c2fbb5cee82d9af62ddd35f12129575b79a17b129c4f6d19218c20840f6

SHA512
a5239c092c0ad1191a17bcceac2ef322635ba441e28643b7e00192254d3eee6c9b0bb5f5c5a3b3d09b60a467bb996d63ff69e63fb7509511409e82cd3813bf98

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/RENYQEO.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/oat/RENYQEO.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/oat/x86/RENYQEO.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_DynamicOptDex/oat/x86/RENYQEO.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
49fc17e7991e2e8647e46544816c9e90

SHA1
a8b0a97d64051ade67c3c444fa19404b11d09a34

SHA256
90b7c71f5cc059f52671e0f77156bdb9a1ecd5999282c965e75a6dfc23b54213

SHA512
b1547a1bf44cec7ac38565c4a0e7188d689df7dd875e18d18b57137958cf7133194338c3daf0529983a9c807bd9f20927229db451b3d585e7a08d25492b4a516

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_webview/Web Data-journal

Filesize
1KB

MD5
2f63ec2c6d4a12b526645656ed372b40

SHA1
59c85988f5b5ea848857356f68b5bcf92e201d2e

SHA256
cb2200f9ff2e2cdbe52efd223aa872f890993d97e8af83a2f48d588377602d55

SHA512
63b7f43aaf8cfb506b6492f01a068badafab89aef4553ed96539a5b2ddbb3e1c2e26d143842e6d3d488a27c1ef42d18b3e9b5a8f46860c03ba0e049ac68da40b

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_webview/metrics_guid

Filesize
36B

MD5
187f76b5a265ffb69a0126f675dfbc8d

SHA1
16e397c5ca0315f937a26463d21119f7bebe8175

SHA256
0b1136644767a5afe9bc9a0579075b30c42979f859567fd8e64da68d333d711a

SHA512
32d127b7760bd104fb254c78b09b1306d717e761f1365aa7ae7308b0c94233379fae0b151a03ced27950ea3aa093fce49645080e32f2a06c38be4083b9db05e0

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/eqlkqihxfaza.eycquwzufnziqqjckzxpksnmluo.begreeacocwxef/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit