alienbot | 67d2f328c59f4a2866006cdd18ca81c9e3f882d585fc42b244ff397293087c44

Analysis

max time kernel
608473s
max time network
174s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
02-06-2022 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67D2F328C59F4A2866006CDD18CA81C9E3F882D585FC42B244FF397293087C44.apk
Size

2.3MB
MD5

3efa6d294bd8115fcd1b228fbb388a44
SHA1

11440309458acdce2514b531ea1057f4a8ed04c1
SHA256

67d2f328c59f4a2866006cdd18ca81c9e3f882d585fc42b244ff397293087c44
SHA512

c4b3ff7287dc7fc7c7359c8dd8ffb4c2eb0dc39a0f5d3305aeb69225d54b0dd15272d0cdc5086bb79d18a05f22e06b48481fc8b96c55087304693551265c8075

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://ukalasey9.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json	5066	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json	5108	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/oat/x86/OO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json	5066	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf

ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5066
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/oat/x86/OO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json

Filesize
706KB

MD5
e9646addf858cb8fef1340cf602b54c5

SHA1
5b88752ec68102c6f53869c5fc528e0767a0d8f1

SHA256
4eba0bb2141a6f6d6f62e10c2f1c01ae770ab2041da4329b718c2aa2f21ce6bb

SHA512
be2dc2dfef19e265c3569211248e8ec43a69c2ee8413735f4249c55be3cc87d2163361792a15e444be890fed8563e1bf3c2576bdf80b015565bc210e11da31ad

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json

Filesize
706KB

MD5
eed7eac54814ff6acec44d5a14a1a4f9

SHA1
c80b000cc27762330e7fb7216f6dcc626675e9e7

SHA256
0242de382adfa4be23d52722eb2e8e679fa9d5475af52a546ddea08ea182b772

SHA512
4f3dfa5d653c7ce20328c950ea87b2e3fd6f03722d305cdad0ea708142131b994efccb64c3e0d51b512bd1ade0bf9ac71964f86f1644e92248da8efae57d6889

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json

Filesize
706KB

MD5
cd9be3cc70e271e1411448d4e97bfdb0

SHA1
73dfa21e3169852e2cca1727c067cf312b47944d

SHA256
24a3c1528d837ee6bec088511d693fab21490aa57618b0a67a3efa7b6beb916b

SHA512
9ec842107fc6cfc56b1efe7f034bc9faad68578625065d836da78d8d79f64c1106641dd1039147d547d93c1fda8c1c3af3829a98b9813e112a8ab915a1414149

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json

Filesize
706KB

MD5
eed7eac54814ff6acec44d5a14a1a4f9

SHA1
c80b000cc27762330e7fb7216f6dcc626675e9e7

SHA256
0242de382adfa4be23d52722eb2e8e679fa9d5475af52a546ddea08ea182b772

SHA512
4f3dfa5d653c7ce20328c950ea87b2e3fd6f03722d305cdad0ea708142131b994efccb64c3e0d51b512bd1ade0bf9ac71964f86f1644e92248da8efae57d6889

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
3c6f22a0a4fb60b405bb6e033e205525

SHA1
aa52d867c88393d015503c3d4c51102d990279dd

SHA256
6f1df106908989508235287c5b631c12a40c70b1f2f82065fe1401ae53e35289

SHA512
1055a0d5408cbd8e200683692c2499fc9f708110efc1172ce6f712090c8631b76a320d4751c568e2e79fb39c4c879c4b17361fd31fe7328727b5336af9d0de1f

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
5b64663dbd88a1ba79cc1e68b8517a7e

SHA1
989fd2a19e74ff68e7cf91ec9a6cd44d516708a7

SHA256
0441988b6ca5d8fcf20a745ffce5819d91dde0abfbba0a34da28da2a0d600c88

SHA512
a1fff7cb7f6b491b2fdfe1bdb605e3ad80244fa0fc96922a3d93b7d601b80120b6c64bbe6821186f1ea1a690601d81396c7405e84eb82d40472830158d583db8

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/Web Data-journal

Filesize
1KB

MD5
678f93500763444a0a6d157dbbb83cb0

SHA1
1b201de60e286334af97a3c66d38c5c378669218

SHA256
23562d0407e8fcd54667e7efc7878c96a9d3b47df77cbb2428279e3bce499736

SHA512
dfc7865ff102890eaac0a796cec57c19fea4407a342654a28e2ffdda20a13cd5af81c108227188acafcf8bf1390e4642e4c3b9c5c78c85fd2a3ac52ac0fc5da1

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/metrics_guid

Filesize
36B

MD5
86254ef29910c4e60d0d1af00865b8c7

SHA1
457431b63a9c68682cb0ec5ab4fb910f77f8bc68

SHA256
2e925eaf137514724261128a7b3b0f48147c4358074c5f40ce341bd4e87787e9

SHA512
72444fc138acb70b43eda63172afe3c372a170ed9fac090cd98bb9b3bb7a7c323ec840b6f2d971c4f4990243133a026218d8b95893a2f534763fc2b0481755b6

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit