alienbot | 73f628bcf2f8618d49ca03ac59b7da23df28131a76b450a3b9254751afef6c1b

General

Target

73f628bcf2f8618d49ca03ac59b7da23df28131a76b450a3b9254751afef6c1b.apk
Size

2.0MB
MD5

43b6ca712be5a971182a1e981c0f9d5f
SHA1

9175769071b277e3230dfdb94d2cb1d19e8b7341
SHA256

73f628bcf2f8618d49ca03ac59b7da23df28131a76b450a3b9254751afef6c1b
SHA512

d00650e98ea177513ad3488cfc15b1d4a4130da4e05d4fe911a17bd829b955fd74642fd7a9f59b628a712a591a6f649ba3c6c9197b3f461fd0bf9ddf294c3a50

Score

10^/10

alienbot banker infostealer trojan

Malware Config

Extracted

Family

alienbot

C2

http://roseletters.top

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/iFTI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/oat/x86/iFTI.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/iFTI.json	5098	agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry
/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/iFTI.json	5151	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/iFTI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/oat/x86/iFTI.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/iFTI.json	5098	agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry

agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5098
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/iFTI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/oat/x86/iFTI.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5151

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/iFTI.json

Filesize
647KB

MD5
303705f70c2ddefda5b88bfa2fa1121b

SHA1
0b9c47cb89ba4ab8e3660f57adc41fe6d5c3a6d3

SHA256
2454a3c6862cb41745f40e5516f4365ccaef5e25a4fd85f3df92457bed10ec62

SHA512
454d6789e3f68cc2e7efb2d3724ceedae360046c74003a7e89cf7d269ad50d64558084f3d8cb9667d5a1c8061abea14136c9c732655b670caa4800ab4fdcd3e6

Download Submit
/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/iFTI.json

Filesize
647KB

MD5
e832a3c2f43a9995e4e0e6f193d7871b

SHA1
311c97a1249460e7b7f90e4b91d55d4db7decb5d

SHA256
8493a5ac025693175950e3948f7a303e6da12dbb4a45d9003e29bd083e2f014c

SHA512
393c3b3533d55ea3ed61252b8471617993c30ea665b1c5b7713c3631eef67b7f5651007721968eb6fa9161093d08d62164aea7286cb40e2cb044f473ab6c8124

Download Submit
/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/iFTI.json

Filesize
647KB

MD5
63c261a30ccc83b59e7edb96ddd8b657

SHA1
375ed2797ed9dbb51993ae2738ef82f2b8a96855

SHA256
2ecc3c2a306cfa345922385655904e02239a1c480d9247bbefca8b9bc8dbc88b

SHA512
801021ab09683e1c8041ad7e5d17ce49dfbe9a94dca4378838152416db2bcc7a3bc191c1e548363e33a9d6263c31a7fea0c5d7c9143d6f55aa2b47c3be23afbf

Download Submit
/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/iFTI.json

Filesize
647KB

MD5
e832a3c2f43a9995e4e0e6f193d7871b

SHA1
311c97a1249460e7b7f90e4b91d55d4db7decb5d

SHA256
8493a5ac025693175950e3948f7a303e6da12dbb4a45d9003e29bd083e2f014c

SHA512
393c3b3533d55ea3ed61252b8471617993c30ea665b1c5b7713c3631eef67b7f5651007721968eb6fa9161093d08d62164aea7286cb40e2cb044f473ab6c8124

Download Submit
/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/iFTI.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/oat/iFTI.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/oat/x86/iFTI.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/agayeahlbbpauqlprh.twcdrj.pympkpnfgkrunjgjiooxry/app_DynamicOptDex/oat/x86/iFTI.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing