alienbot | f3c92170b3655425ff96e9bead2fcd1ced5d71616ade339c7a32e2ed8574eed2

Analysis

max time kernel
4167287s
max time network
159s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
24-05-2022 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3c92170b3655425ff96e9bead2fcd1ced5d71616ade339c7a32e2ed8574eed2.apk
Size

2.1MB
MD5

0c118df69acbfbda3de3372567371052
SHA1

0d96435b20d4e4cabd0dfde79ceb812cb1417cfa
SHA256

f3c92170b3655425ff96e9bead2fcd1ced5d71616ade339c7a32e2ed8574eed2
SHA512

2d41f215703c9f5e709babe6a45945c385233be8adc03d0c68fb971dbf2b253f30e08195f2ef33a7c4d41b6d69a7d867343fe73ea69c17d3d41f675001794c7d

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://seachkanamali.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu

Acquires the wake lock. 1 IoCs

Processes:

mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/rQc.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/oat/x86/rQc.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/rQc.json	5165	mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/rQc.json	5291	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/rQc.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/oat/x86/rQc.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/rQc.json	5165	mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu

Removes a system notification. 1 IoCs

evasion

Processes:

mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu

mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5165
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/rQc.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/oat/x86/rQc.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5291

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/oat/rQc.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/oat/x86/rQc.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/oat/x86/rQc.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/rQc.json

Filesize
750KB

MD5
f7663ead36986c3817799aa5848d8e4d

SHA1
05a07c288646818dd832f818de9621543abb5ab7

SHA256
04f53b2431c89a4b839b3ba87fba1f196bd35c619f76114f3b5f0e6c86427641

SHA512
9552bc756f6d17bc49b48fcd1353e38a7fc8648a6ead03f98fd29de252f643a906ba6f5920ea3d3c6ef152a51d3a39eb7a07822e5c0e3d5a6e713b1801218c48

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/rQc.json

Filesize
750KB

MD5
d1c726a946963c912eddb011d3650d1e

SHA1
e0a8702098a591ab9dcb955977ac9381757a2b60

SHA256
e4c6167efb22cfb40d89b72d3edf3f8c7cc0a0cb1b5fd213bc549e0174561abf

SHA512
78db15fa989fab3af7372dc3d533882afa167a055dd8aa087fbcf0965dafdb9a1b90341c2bfc45e28a11069b275486ca03dcbb19ca85d1fe7b7c7e8f9e0b8f31

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/rQc.json

Filesize
750KB

MD5
405e03c34fe992aef2d3d3936fca4104

SHA1
b745feef98b5aa42170f813c97c43c00d5aafe58

SHA256
125b38f04d849a6b4dde6e30e2760dd40749525fa7a9816a4a5f93839737e9c7

SHA512
f759cee9cde535137e1d1943b54ba32f40e955e78a257b193c5d87a6ca54f5cb93617da708538ce4ca2f8d84e6d38b798f35718d725f609653db926ce436229a

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/rQc.json

Filesize
750KB

MD5
d1c726a946963c912eddb011d3650d1e

SHA1
e0a8702098a591ab9dcb955977ac9381757a2b60

SHA256
e4c6167efb22cfb40d89b72d3edf3f8c7cc0a0cb1b5fd213bc549e0174561abf

SHA512
78db15fa989fab3af7372dc3d533882afa167a055dd8aa087fbcf0965dafdb9a1b90341c2bfc45e28a11069b275486ca03dcbb19ca85d1fe7b7c7e8f9e0b8f31

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_DynamicOptDex/rQc.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
53439e3c57d2afdecc7abf7d292ec138

SHA1
5bc5fa1365ba17ba88aabc639b47192ce92d49cc

SHA256
b60dd2b6ce85d743cffa5e9e078a7fc0eb36dec6256dca0f0d64071f110f226b

SHA512
0017d26eb0875931f0dde8a1da1db63a2b4928003476b453a66ebd93449f85042d6287845ae5a055085701025311585d58eecf71fc76463a4df48eaae16c55d9

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_webview/Web Data-journal

Filesize
1KB

MD5
88b400d1adf350295c7a9076d5fe6ebb

SHA1
7aafb2c7f600033d054ab2b8cb59b92dd14fb30e

SHA256
8a96a1d5734e0d320f1a71c0933c5dd4dbe4fd78a28abbf590c054d7eb90a492

SHA512
32c9d71949449335fdadcd98e8b93a116dae029f81d1e11d11d2a8953511d3d573e4040c357ced3776df1a78618b4518bee5757bd1d54521240b48dda48d680d

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_webview/metrics_guid

Filesize
36B

MD5
96ba330f70518ce7f6f18c60242fe99f

SHA1
a6461062137e4f78e1949c07dccfc9d4228540af

SHA256
0f0de94a70b5a4c8a633fb4b6861d0384f708a2d801c95b47a23915020525367

SHA512
583b336d883849897250b9357a8342fa6ecc4f1bbd60ed16444caad0178cfb29013db854c636fc10379e3f51dd8229a7ad131538c1757c97a60ef940af587180

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/mgqys.leybnsdfpngzljpsbshnxkf.xzbyugsdu/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit