alienbot | cc5f4a18e941c2fa4a18eef960d33d1a117ad25c58cd918d41fccf16c3e0097e

Analysis

max time kernel
4171743s
max time network
144s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
24-05-2022 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc5f4a18e941c2fa4a18eef960d33d1a117ad25c58cd918d41fccf16c3e0097e.apk
Size

336KB
MD5

2029dc4e50b8ef17073bca6c129afd1b
SHA1

c36f206e599359cbf9a64b409713c5d21c6d5009
SHA256

cc5f4a18e941c2fa4a18eef960d33d1a117ad25c58cd918d41fccf16c3e0097e
SHA512

9ec1d1425c2e051d4c75f9db17918fff1a3dbacfa22827f9cd2ab320a1e75f1703e0da98f63cf49a4eff93a92c8c4452d4de1687f7bd7f5b8e05d1fccd498421

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://digitalmark.top

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.yzqzuyhrdwemb.tcyuqwk

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.yzqzuyhrdwemb.tcyuqwk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.yzqzuyhrdwemb.tcyuqwk

Acquires the wake lock. 1 IoCs

Processes:

com.yzqzuyhrdwemb.tcyuqwk

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.yzqzuyhrdwemb.tcyuqwk

Removes a system notification. 1 IoCs

evasion

Processes:

com.yzqzuyhrdwemb.tcyuqwk

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.yzqzuyhrdwemb.tcyuqwk

com.yzqzuyhrdwemb.tcyuqwk
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Removes a system notification.
PID:5158

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.yzqzuyhrdwemb.tcyuqwk/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.yzqzuyhrdwemb.tcyuqwk/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
456015881142848886036b3fc8b67d7e

SHA1
06bc9516996304c40fce4b6b42cab663f9117f21

SHA256
1239a496d0e3f5af7f78719094523c39673ad3f0e3e933c8bab309443b385dee

SHA512
d2a7c2b8f1b1a3d887d05568e8e995f85df862d6cfe4216da4cb7f7206491fd2d8b145abceff3502ecd49861e025221ef064d2e293a700ff40bac78777603aad

Download Submit
/data/user/0/com.yzqzuyhrdwemb.tcyuqwk/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.yzqzuyhrdwemb.tcyuqwk/app_webview/Web Data-journal

Filesize
1KB

MD5
9eb750d9396252ac6661528ab27885fb

SHA1
ffa83533e97c6a91a043862991d233f21f192f8a

SHA256
3cbe6fdebd273f46d7be0e37aa6a244e67806c1a5b58b0181c2964e323501116

SHA512
c08c500285ba649edb0a2baa5698bd7c8be6fb763ccfedbcfa738847d777b782977ec8cdda3760160e0271551714c64d175187c6fe64f2312fb69ac462bd9a2e

Download Submit
/data/user/0/com.yzqzuyhrdwemb.tcyuqwk/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.yzqzuyhrdwemb.tcyuqwk/app_webview/metrics_guid

Filesize
36B

MD5
5185b6916f509910d781c777cb53f9fd

SHA1
0effb004b865ff3fb9ad3ac1805ba2b738003f2e

SHA256
223314318fd3cca482a972ab534953269299f6fa696c5471abdae036c068cd0c

SHA512
e5fcac6d6062621cadb737191b773f387c263bec66da7d4d6c1c76f8751b445c76878ff45b0bdb86ef86826d6277e80922c9f3257fc8809c0df784c5e95c670d

Download Submit
/data/user/0/com.yzqzuyhrdwemb.tcyuqwk/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.yzqzuyhrdwemb.tcyuqwk/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.yzqzuyhrdwemb.tcyuqwk/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.yzqzuyhrdwemb.tcyuqwk/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit