alienbot | 4fd61deadc84584edcc74e460877946f76740015aa15a208a5466e31e8502db1

Analysis

max time kernel
613618s
max time network
155s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
02-06-2022 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4FD61DEADC84584EDCC74E460877946F76740015AA15A208A5466E31E8502DB1.apk
Size

2.2MB
MD5

8c254f45c9c31ae441691da4840d4677
SHA1

6270a5b2286a21c1d4706594dfdecc31e6ac6520
SHA256

4fd61deadc84584edcc74e460877946f76740015aa15a208a5466e31e8502db1
SHA512

bf99bf6872821d5d161232a6a0b515d26f44b9d41dc0c5c2ccd338d4b3c95e38c6dff6151288d0e1c6f77066e226f8de7fb8688c27d6b949d6fc8dacbfeab6e3

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://kolombickmolonick.site

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

nxnlfydxznzcnnoi.rfslsde.obtjkugx

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	nxnlfydxznzcnnoi.rfslsde.obtjkugx
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	nxnlfydxznzcnnoi.rfslsde.obtjkugx

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

nxnlfydxznzcnnoi.rfslsde.obtjkugx/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/Ud.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/oat/x86/Ud.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/Ud.json	5243	nxnlfydxznzcnnoi.rfslsde.obtjkugx
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/Ud.json	5349	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/Ud.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/oat/x86/Ud.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/Ud.json	5243	nxnlfydxznzcnnoi.rfslsde.obtjkugx

Removes a system notification. 1 IoCs

evasion

Processes:

nxnlfydxznzcnnoi.rfslsde.obtjkugx

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	nxnlfydxznzcnnoi.rfslsde.obtjkugx

nxnlfydxznzcnnoi.rfslsde.obtjkugx
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5243
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/Ud.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/oat/x86/Ud.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5349

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/Ud.json

Filesize
689KB

MD5
fffd49ff241f0d3d04fea4457aed8baa

SHA1
28f765ef85f05587021ca1fe64adad0c8089aa44

SHA256
a99bf68645f8e3f88a3db9241721ff057cf78b209919086b58fecf53d07d9822

SHA512
31cd9fe404b0ab6808d6079eb3f3898ff9c176ba67690a308305054bd80ca0e6f926c4859e950e10ad83badaf73153e4d13ba9107c69164788f5d76d98f37282

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/Ud.json

Filesize
689KB

MD5
a51e83e50e50915bc9289d798a065320

SHA1
75c9f2811f9c50d9b59a2a23273919137a83d74a

SHA256
81c4e6c64c2d745d848cb0d998e9078ffd2df71ef85ea7af6680b543fbe454ef

SHA512
d2a4c126b8003485cef64d3ec15e48ad1b5b0c2b5322dae09d2e0096f119470b8b25c0e2e9f33a75d9351666a610c68521510d99e7099e5fc31125dffa137944

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/Ud.json

Filesize
689KB

MD5
a777013d8b5cf851f614af8d34e2dcac

SHA1
69d2d04c2c1092580e8fa23c26d150f1d0722073

SHA256
0bed2523fdf15c7d1d202fc20a6005a1e95bde5dfd6416c4d4a39480397e549c

SHA512
5852464cab5a6e863befa7fd525500b28105eb889d77bce3b4656dae67f0f0015b8fa128d9db582a5486d3dd1218ff3d0442a6d3c09daa68f4aa024c9f20266e

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/Ud.json

Filesize
689KB

MD5
a51e83e50e50915bc9289d798a065320

SHA1
75c9f2811f9c50d9b59a2a23273919137a83d74a

SHA256
81c4e6c64c2d745d848cb0d998e9078ffd2df71ef85ea7af6680b543fbe454ef

SHA512
d2a4c126b8003485cef64d3ec15e48ad1b5b0c2b5322dae09d2e0096f119470b8b25c0e2e9f33a75d9351666a610c68521510d99e7099e5fc31125dffa137944

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/Ud.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/oat/Ud.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/oat/x86/Ud.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_DynamicOptDex/oat/x86/Ud.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
787d10d4e5e404efa0f6a091340dd207

SHA1
8e1e9df789b70dbe6a80dac771192ea95980fbc4

SHA256
e5538c8c8c9434477944a3714bab9d8bf0b68b9580fa7e68611526476f1b8dc8

SHA512
b851834f91ce30b29dd47d245ccd3e01e0a37f05a376c0c9c9351df29576d03865f6233400ac17974eae908e3a654317df8a70129c9b3ca965501d13fe3a94ee

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
26ae1de5f6dc0a290a07653e44765dd1

SHA1
86baafae97f7d6aa903d93499fe147c3dd9cf529

SHA256
fcaca03f355179c70cc4adbcfb869ff03dff63c0e406de6e5a94bbb75bf600dc

SHA512
76c67e8fe11d981bf891f10f67c1f686a73ce90e99123b28c3c48e08dec70f30f0d1879bb8b74f459b7ebdb66c9711ec033a5d97009cb91ed02424bd10ae160d

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_webview/Web Data-journal

Filesize
1KB

MD5
69a8faba7add275a68a8840caf13a4ca

SHA1
51e75b7359a99a2ae8769e3227e5525d0ca59eae

SHA256
169fa37b3ada68375c3b998cbea03af73501f8ed0072728b2bdc1552681a9ba7

SHA512
25b36f99cf7a283bee80d91a1d90c08127041d25e42cd20e059a83c1dce6738bbb40c5c407ad634e4d97df3e3507a36bffeadee76cf6a9f56dd4c16edd3ac2c9

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_webview/metrics_guid

Filesize
36B

MD5
806cca4bf66522a6296feafb9d3180c6

SHA1
bb26fff8669f220ff712672f458919b8d9cf56c9

SHA256
f51e3751304d7b555a5d4e7d1a3e2701061738a2c0408b97389347acb729e8e7

SHA512
d8ab9063958c1615d2453f83d1263029cb7a8ef9817f91b67d0fffa17bcf5abe667b3ad1766150e36a75e2d0bbd86c40152ccb14d73b235ebf986d11b9afd27d

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/nxnlfydxznzcnnoi.rfslsde.obtjkugx/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit