alienbot | 41c116b17277f318484d46c3c04fcb0d9d6eef33e9149b5c85765e96e5186abb

Analysis

max time kernel
4163767s
max time network
164s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
24-05-2022 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41c116b17277f318484d46c3c04fcb0d9d6eef33e9149b5c85765e96e5186abb.apk
Size

2.1MB
MD5

2fee475cedd49de458299e569b56c16a
SHA1

0ff679464234fc2b2583de99e5051f16a3799f46
SHA256

41c116b17277f318484d46c3c04fcb0d9d6eef33e9149b5c85765e96e5186abb
SHA512

8c9e313e77997c06c41c0fc1d0ec68e6b95e26c1499f72be5c904943cf9a0a26297a856dc834bbec5e66711ff978965ac47fbd064797e8c95a91ec2273fd1b49

Score

10^/10

alienbot banker infostealer trojan

Malware Config

Extracted

Family

alienbot

http://densizinhakkindanimansiz.top

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

hktonmtokknkmn.zybsb.iqeqoptginp

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hktonmtokknkmn.zybsb.iqeqoptginp
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	hktonmtokknkmn.zybsb.iqeqoptginp

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

hktonmtokknkmn.zybsb.iqeqoptginp

ioc	pid	Process
/data/user/0/hktonmtokknkmn.zybsb.iqeqoptginp/app_DynamicOptDex/sI.json	6237	hktonmtokknkmn.zybsb.iqeqoptginp
/data/user/0/hktonmtokknkmn.zybsb.iqeqoptginp/app_DynamicOptDex/sI.json	6237	hktonmtokknkmn.zybsb.iqeqoptginp

hktonmtokknkmn.zybsb.iqeqoptginp
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:6237
- getprop ro.miui.ui.version.name
  2⤵
  PID:6439
- getprop ro.miui.ui.version.name
  2⤵
  PID:6534
- getprop ro.miui.ui.version.name
  2⤵
  PID:6976
- getprop ro.miui.ui.version.name
  2⤵
  PID:7366
- getprop ro.miui.ui.version.name
  2⤵
  PID:7406
- getprop ro.miui.ui.version.name
  2⤵
  PID:7437
- getprop ro.miui.ui.version.name
  2⤵
  PID:7472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/hktonmtokknkmn.zybsb.iqeqoptginp/app_DynamicOptDex/oat/sI.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/hktonmtokknkmn.zybsb.iqeqoptginp/app_DynamicOptDex/sI.json

Filesize
660KB

MD5
c93aecc4198b2ecfd78fb3aca660e5e6

SHA1
7a23404d262b3532657c42a9eb00b254836ff2e1

SHA256
f0548092bcabf9a60b25945006a16022c37b041a8f79a5f656f49bdb41fde9c5

SHA512
cf1c8bd28ebfae8283d25abc3fd1a8edfbfb2a50f97342b38cad16e9071661ddb34f506a1a791a74a481503fd5ced619285184c8cf654f31a8e6f0c9e791f023

Download Submit
/data/user/0/hktonmtokknkmn.zybsb.iqeqoptginp/app_DynamicOptDex/sI.json

Filesize
660KB

MD5
7eb2125ecea4e04b3d20e70dfe704629

SHA1
fb5cf7e3dca7d5ff02bbc5e3053dc481bc8e6a5c

SHA256
16d93618f989395abdebb1a042fab87216e4903589fc857a5b0e058bf01ca66d

SHA512
10f6b6853cb95a0f7b32967af3dc38bb4934816d7490880da108f8910c2ded3f9297121dba8aefa5c4d68aa3174819f1d87fdfc04ad7b397642a9bc33c6db153

Download Submit
/data/user/0/hktonmtokknkmn.zybsb.iqeqoptginp/app_DynamicOptDex/sI.json

Filesize
660KB

MD5
7eb2125ecea4e04b3d20e70dfe704629

SHA1
fb5cf7e3dca7d5ff02bbc5e3053dc481bc8e6a5c

SHA256
16d93618f989395abdebb1a042fab87216e4903589fc857a5b0e058bf01ca66d

SHA512
10f6b6853cb95a0f7b32967af3dc38bb4934816d7490880da108f8910c2ded3f9297121dba8aefa5c4d68aa3174819f1d87fdfc04ad7b397642a9bc33c6db153

Download Submit