alienbot | 416b8132857e150bbb4b8dab7ffe94d28d13c485efeb54afe2e58ccca7361d42

Analysis

max time kernel
613429s
max time network
157s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
02-06-2022 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

416B8132857E150BBB4B8DAB7FFE94D28D13C485EFEB54AFE2E58CCCA7361D42.apk
Size

2.4MB
MD5

f065d7db0a94da8f2556f094245baf21
SHA1

45ec5c68a522c1f8806a0b467fb8a89bb0fc57e9
SHA256

416b8132857e150bbb4b8dab7ffe94d28d13c485efeb54afe2e58ccca7361d42
SHA512

9b3e0e85fb6a2db82d8d16b17756b02367cd64e85cd4a3d3f569c60719ed61f4f4cfe010186473819a617e3d6a5ba678093af24dbc3152eb1a2c9a2105aaab8b

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://kucsas2.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/oat/x86/jw.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json	5124	ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json	5155	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/oat/x86/jw.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json	5124	ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd

Removes a system notification. 1 IoCs

evasion

Processes:

ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd

ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5124
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/oat/x86/jw.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5155

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json

Filesize
610KB

MD5
04ba0b0fe366b58c33e7d13d757ce320

SHA1
2412a790bcec41d7fc1ff2ad7f16e50938fe56df

SHA256
c0d92b5532c8e216d6ec94d552343839797e5a56c3a204e8a845ea5c5c5e1cdf

SHA512
00508b7df303d2e6ceeaf4f7c4fbfe9ff4c512da515f5d67fb3d89b51f291df4c0809bd9f3231bbed7628975f63c699f3311bc107ce331d52d80e4e975e771e7

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json

Filesize
610KB

MD5
bf063aa2119c8a4dc6f3cc781ffed21a

SHA1
7cacf797b5e7f6e94ddb1920f38095fbeaca02dc

SHA256
4a2a9a37989ad92b6e1c31d4f5d10769ac4e870a4ab3ab189ba90360121ce07d

SHA512
088df9cacbbbe8741793c08ef0ceaba94483176de53740c45fb9970782eaf9dcd7465686e9e1233ddd408f0726336789872a6224f4cf16d62fed8b94b566ae69

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json

Filesize
610KB

MD5
921b2019cfa61bb9f1a449d3498ccc03

SHA1
00c2b251ac49c59c13029257240ab6792e509a70

SHA256
b0c06be6f842973e8800e274071ebdb9f30f3520b9327dd7843af0164af232c7

SHA512
6b6169f3462acc0a60608c4d69f33a3e6b4823c3dfa06ad8d677751c23af09d561762b7dc7bad74ef228291b17eb2f2529e51f6d1724f1fa53bff74857133f09

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json

Filesize
610KB

MD5
bf063aa2119c8a4dc6f3cc781ffed21a

SHA1
7cacf797b5e7f6e94ddb1920f38095fbeaca02dc

SHA256
4a2a9a37989ad92b6e1c31d4f5d10769ac4e870a4ab3ab189ba90360121ce07d

SHA512
088df9cacbbbe8741793c08ef0ceaba94483176de53740c45fb9970782eaf9dcd7465686e9e1233ddd408f0726336789872a6224f4cf16d62fed8b94b566ae69

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/oat/jw.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/oat/x86/jw.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/oat/x86/jw.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
dcb2d4d13a2d430cc1e78336c15a6da7

SHA1
8643e3120825ce929f0cbfb161e657a8bad0660b

SHA256
0b99cb1a22b40bad7d39d660b6cd3c58f6faba70f15f484e3de85254c1073dee

SHA512
46edc1771103b66dec5a63b388d13902de89ab97831f9213ce73e249459ec5a918d9a300369ccc9282b262dcc9f37333d237978a77de9daf89e22a26afa1c991

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
07b96282bd2580fac54e5666bab6b364

SHA1
d7c642e59c4b0758519f83f08c98611a215d2d5a

SHA256
ae3faecb7c8da227216185cbee9c88ea7a879bdfb70f08a30f5b6a2c41b53c72

SHA512
0a4d1a338c1d529d520c0f2a1325278a3177d1b074f6926c48542c4ca6a6e3b2a67352787eb69907a2389e8c52be611241c0a8c401932b52769db567e80dc515

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/Web Data-journal

Filesize
1KB

MD5
97f67b261098c08a294ba5def9a7437e

SHA1
22b111f645b2cbb1f47cd553e8d6c121e39b1117

SHA256
895561bc29242ced2fd76b0fb42433e335e7167f10c50d82a7bdc3fbecf21b20

SHA512
4d7fc9e16fef41a47010b55278519f6d397f7d42e1a5a173cd671e607f594eee436deb78d7cec70fe47691a0a264816766bab2e8c3e38eaac27de2dc2d9313eb

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/metrics_guid

Filesize
36B

MD5
07f478f20d2ec847a93e55ecf98dce22

SHA1
36211b469c6631f5478cf480a384bcd9189bd975

SHA256
8b6c90469412dec0a18cea93bdeb63d0e314a791927d7f335055cd189f64de25

SHA512
92fa77100b2afdc7a1cf3dbbfdb5a4d34fa011475c8328084b0befd810a0240f252b916dce6a0e5c02bc168c98a03026d055acb621338ea85604b7a9875c18a1

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit