alienbot | 67d2f328c59f4a2866006cdd18ca81c9e3f882d585fc42b244ff397293087c44

Analysis

max time kernel
613080s
max time network
157s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
02-06-2022 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67D2F328C59F4A2866006CDD18CA81C9E3F882D585FC42B244FF397293087C44.apk
Size

2.3MB
MD5

3efa6d294bd8115fcd1b228fbb388a44
SHA1

11440309458acdce2514b531ea1057f4a8ed04c1
SHA256

67d2f328c59f4a2866006cdd18ca81c9e3f882d585fc42b244ff397293087c44
SHA512

c4b3ff7287dc7fc7c7359c8dd8ffb4c2eb0dc39a0f5d3305aeb69225d54b0dd15272d0cdc5086bb79d18a05f22e06b48481fc8b96c55087304693551265c8075

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://ukalasey9.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/oat/x86/OO.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json	5273	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json	5328	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/oat/x86/OO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json	5273	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf

Removes a system notification. 1 IoCs

evasion

Processes:

ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf

ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5273
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/oat/x86/OO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json

Filesize
706KB

MD5
e9646addf858cb8fef1340cf602b54c5

SHA1
5b88752ec68102c6f53869c5fc528e0767a0d8f1

SHA256
4eba0bb2141a6f6d6f62e10c2f1c01ae770ab2041da4329b718c2aa2f21ce6bb

SHA512
be2dc2dfef19e265c3569211248e8ec43a69c2ee8413735f4249c55be3cc87d2163361792a15e444be890fed8563e1bf3c2576bdf80b015565bc210e11da31ad

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json

Filesize
706KB

MD5
eed7eac54814ff6acec44d5a14a1a4f9

SHA1
c80b000cc27762330e7fb7216f6dcc626675e9e7

SHA256
0242de382adfa4be23d52722eb2e8e679fa9d5475af52a546ddea08ea182b772

SHA512
4f3dfa5d653c7ce20328c950ea87b2e3fd6f03722d305cdad0ea708142131b994efccb64c3e0d51b512bd1ade0bf9ac71964f86f1644e92248da8efae57d6889

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json

Filesize
706KB

MD5
cd9be3cc70e271e1411448d4e97bfdb0

SHA1
73dfa21e3169852e2cca1727c067cf312b47944d

SHA256
24a3c1528d837ee6bec088511d693fab21490aa57618b0a67a3efa7b6beb916b

SHA512
9ec842107fc6cfc56b1efe7f034bc9faad68578625065d836da78d8d79f64c1106641dd1039147d547d93c1fda8c1c3af3829a98b9813e112a8ab915a1414149

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json

Filesize
706KB

MD5
eed7eac54814ff6acec44d5a14a1a4f9

SHA1
c80b000cc27762330e7fb7216f6dcc626675e9e7

SHA256
0242de382adfa4be23d52722eb2e8e679fa9d5475af52a546ddea08ea182b772

SHA512
4f3dfa5d653c7ce20328c950ea87b2e3fd6f03722d305cdad0ea708142131b994efccb64c3e0d51b512bd1ade0bf9ac71964f86f1644e92248da8efae57d6889

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/oat/OO.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/oat/x86/OO.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/oat/x86/OO.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
15764f80641bdb0af22911955a5648c4

SHA1
455c8feea831a05ea65de42d67bb9830e061585c

SHA256
c2e171e84d608a7499ae8c8ba39fb2ea7a47a6accad1eef6ccee382ba4f5833e

SHA512
3306b29032c4ebea507e026e0ff497f912d05e044448d4fa6e56e0c01a76a0181ad2fb80499b840c7a1e0ab9bcb7a4dd682002a7d68a59973735bfd52f792183

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
2e62f41d6469d2c8a680cee24f80024f

SHA1
dc63a429d77249de5da12486e7b348c87cc0df0d

SHA256
ad8c6e97702b646c63bead3c38eeec685ce66a9d9286f7f9544e16d4deaa93a4

SHA512
c01a6995f9c7a397d0a5a3fde369a2791c891733f9b015ffd265b429849541b8e73a80bfae6f846648eb66710b184b88bad65f94e86b176c5d5aebb0fc0905c2

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/Web Data-journal

Filesize
1KB

MD5
4c9da92ea48b1fcc9efbf153109a554d

SHA1
b6e5c7fbd0930b0feefa09cf99e2e1bd3cdf0494

SHA256
4c9405b21c975484ec54e4798f12d7542decd7e5e8c46ad7c7578dbd5b2d885f

SHA512
b67b22d0ebc8417802d2343748573c86cb87e9a399d8f0dc57a479d3b41f373397d3312ad8e21f765ce519daebda3938ffddc484adfcb127e8d19907dfb545ea

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/metrics_guid

Filesize
36B

MD5
4c23f8fad3c926fd3b10a1a0cdd7ab1a

SHA1
3aabcad9f9759e015f9e66145a74bc239273010f

SHA256
0fe15e9664e7cf5dae9229572097fff57255c1c63201b626f09516820bde45a0

SHA512
c2772f2b934d73c27dcce13f922fd8f4c8bb7a2c1fd8171f1d98b1e2f1369761e1f8785cb2ba259186decd85919ce23212d5f936f15263c5522dc9954553c035

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit