alienbot | 82f984f49b7133b9c5081b7e40fa89125867e6d3e1006fb30013089a463cfcec

Analysis

max time kernel
4178163s
max time network
160s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
25-05-2022 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82f984f49b7133b9c5081b7e40fa89125867e6d3e1006fb30013089a463cfcec.apk
Size

2.1MB
MD5

7cfae3ed58219833949f9d7e79b7b621
SHA1

a0ee356a6a88b60bb7128cd2c7167caa45f5f890
SHA256

82f984f49b7133b9c5081b7e40fa89125867e6d3e1006fb30013089a463cfcec
SHA512

b30aea2132eb9bbb6f96680e14a75be7fabba883f5570ecbae113a92193e3cd1d2008a525551290f34ee15d621caa9f13c8e773e2b506cbce6be104239b363d0

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://hadigelgidelimm.top

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/bUsf.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/oat/x86/bUsf.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/bUsf.json	5213	rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/bUsf.json	5270	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/bUsf.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/oat/x86/bUsf.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/bUsf.json	5213	rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy

Removes a system notification. 1 IoCs

evasion

Processes:

rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy

rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5213
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/bUsf.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/oat/x86/bUsf.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5270

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/bUsf.json

Filesize
703KB

MD5
f9ae9ab06ecbcd3356352189d9e5193e

SHA1
e5edfa493f5a274d446cd86e507bd1dd29766480

SHA256
ff3c86f124f0c36e05fb735d3b9bbf769fe84058d2abd37df6b581e352a3cb6b

SHA512
213b46004fff2d4ea51ce22a821f48153ed2570931645fe25ab6ce3164463fe1d07b164d8fdd985c302fa79802a95626e651f3c3aa9df80e3d115f7a5df9fb56

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/bUsf.json

Filesize
703KB

MD5
093e2a50ff9e98ee3ef48639818ad3fc

SHA1
80b1d35c25b77e72ec20b228153e1a27f577b25e

SHA256
7fb61324349de69a38d7abd4b341b37e262351a2773960b7e8d9ae878f5ad77e

SHA512
6a180a7aa9b2c5e22c6abe2afef58d131b605ef6b17c59403ab5776e2a7e3b34654fdbd4ffc5001c38c29aa2104a9608d7ea767921398d65c282201e64c85317

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/bUsf.json

Filesize
703KB

MD5
4ab6e57e4e5aed77e57a7f2f6adbbcdf

SHA1
6593829167fd6eb7fcf5dfcad15c465edd2af38a

SHA256
c52d23711dc9ab5e3c92516f75d5e31f0e5136bf1099e6c40e77e31c22bf567d

SHA512
a9ee7a9337a57682199f4b5214abf4fb5e6f1a60a4caa911557aace3ab2c7a93a7b4bdccc7a5c79ce7942ca766b1cdf927469229bf32395f26176f14f2f4c2e0

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/bUsf.json

Filesize
703KB

MD5
093e2a50ff9e98ee3ef48639818ad3fc

SHA1
80b1d35c25b77e72ec20b228153e1a27f577b25e

SHA256
7fb61324349de69a38d7abd4b341b37e262351a2773960b7e8d9ae878f5ad77e

SHA512
6a180a7aa9b2c5e22c6abe2afef58d131b605ef6b17c59403ab5776e2a7e3b34654fdbd4ffc5001c38c29aa2104a9608d7ea767921398d65c282201e64c85317

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/bUsf.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/oat/bUsf.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/oat/x86/bUsf.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_DynamicOptDex/oat/x86/bUsf.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
b65d5f1b3c27cbf4afbf3688fb38ef1a

SHA1
006ed4066dfcb25fde2a59ce2c02068c54ccd456

SHA256
651baa1bed5d20a0fc2b972b93ddbba27f5528e8658ed9d07946bf92f633b97b

SHA512
44872f8f7f14f8ff021f3855c544c0ac3b7efcee446a70d7762dec41db9c3e327a1d73624ef799fb325a8151060614ea7d3d7b527fa80d2f5cd934de60722153

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_webview/Web Data-journal

Filesize
1KB

MD5
4f85a8907110ae3b09e56b3bc4760d8a

SHA1
51b634dcc575e7835ea9fdafaed96b3cc976dd65

SHA256
e3191ffbb1a609c92f87e47410175780631d1d9e04ebe6b4a820af045b623827

SHA512
0213797d3aa4ee163d1ee07e1e275917965f132e0eec22b3fccb1d635180b5fc6979589186d5908d56b459de48491514d95dde51c48c79748b29a6c5edbae88d

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_webview/metrics_guid

Filesize
36B

MD5
0ae4355999727650f66f1e64e1e71e89

SHA1
1375a4d05290bac5b98840db401555bfbe57c6b9

SHA256
fb4ec4dc3018e33e76199ae718abadc9e2d08e7ddd065ca95d6d7498702705f7

SHA512
a2af3bc97010d6b1f73e907330b93e2c5d36805fb6061f712e09fb4e5fc62d9dda642f9f6086ae9a2dd6af4cd5f3f50c93d0d3891a60187295f1983511c763e4

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/rxitjkdxwjlx.pzbmqystccfwjmfnoba.wleijlgrpjxmndqy/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit