alienbot | 4fe5c2f3972b2856957742f7bcabf14102cb8d7df71e21c30dc6d6d023e9d7ee

Analysis

max time kernel
613895s
max time network
161s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
02-06-2022 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4FE5C2F3972B2856957742F7BCABF14102CB8D7DF71E21C30DC6D6D023E9D7EE.apk
Size

1.8MB
MD5

985b428c39115820a7a5052fb1e68048
SHA1

e7ed680407b9bbc4eafb3554f83ce34973605f92
SHA256

4fe5c2f3972b2856957742f7bcabf14102cb8d7df71e21c30dc6d6d023e9d7ee
SHA512

29f581db92139a4c23fdd19deda902ff4952a4aa804f678a814562aef50b425943c59ab72c9409a5270f13e1f5213d4f167f810a0e7be00cadfe75ab06e386e1

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://zesasar9.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/EbcJbMe.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/oat/x86/EbcJbMe.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/EbcJbMe.json	5061	tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/EbcJbMe.json	5099	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/EbcJbMe.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/oat/x86/EbcJbMe.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/EbcJbMe.json	5061	tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct

Removes a system notification. 1 IoCs

evasion

Processes:

tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct

tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5061
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/EbcJbMe.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/oat/x86/EbcJbMe.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5099

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/EbcJbMe.json

Filesize
654KB

MD5
30d0e5851dc8d367455a26a74a068a85

SHA1
0333618cd37501cbe490b60d957194c7fd87683a

SHA256
a828abc563b56a790fa9656c195802ff53e3576eab6e3fbbb7744416a4d44397

SHA512
733787302e9cd0fd44dad31f09874c62d26260c2154fa2e1c8fc430724ba4127c316f9716460ef5e19affd894b8c14741680b99a9bc2bac40bd9bbdf29c56d40

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/EbcJbMe.json

Filesize
654KB

MD5
0ee42c3762c0f6c8f42f4a3bf46728e4

SHA1
d56e357fdd3faeda8e4bb9f8d3a48fffa69ad5e8

SHA256
c801d9678fea044e3405162075c7f1501eacba6e01313458b5d54d72f26a966c

SHA512
adef03b13a145ce01da7e531917d139afafcfa68a1de4f5cf15f010e15403bfb50e001c6b084ebb135c7720d606da5cc3407bcb1d5ffc777c41e1cead144c1ba

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/EbcJbMe.json

Filesize
654KB

MD5
0ab40cc598d7ce67c1f1ce69623f40bb

SHA1
abe3bcf47e923dd201eb2148648c8ba68b6a76aa

SHA256
5c0a8436109ccdf9f4efd3100e3112fb01de8fa0d9adac561521ca14c41f79a5

SHA512
b9aaf44ef1578da333d78ecc9b1863d7edd7e9af1d76b7e1df6bba8921ff27b52fecf37894183cffac005d527a097581925338a2c4b03d6305acf8f0f9477a40

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/EbcJbMe.json

Filesize
654KB

MD5
0ee42c3762c0f6c8f42f4a3bf46728e4

SHA1
d56e357fdd3faeda8e4bb9f8d3a48fffa69ad5e8

SHA256
c801d9678fea044e3405162075c7f1501eacba6e01313458b5d54d72f26a966c

SHA512
adef03b13a145ce01da7e531917d139afafcfa68a1de4f5cf15f010e15403bfb50e001c6b084ebb135c7720d606da5cc3407bcb1d5ffc777c41e1cead144c1ba

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/EbcJbMe.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/oat/EbcJbMe.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/oat/x86/EbcJbMe.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_DynamicOptDex/oat/x86/EbcJbMe.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
a7df53097f632a698b86a5e6e2cdf544

SHA1
03b08aaec6eee7c53d2fd2481743a971a2d3742d

SHA256
bd08fbcc8b17aa25e632219c5fe48a6abaf785c2db3bbb63cd18ae97dc109e34

SHA512
bdc9e79d143d2ae584051341d2aad81909ef9c80ab61795fe6331b49b28ff7d543c8ea0c0618d8b857e49de0abad71f08b1f92e3467fa0e73b88978b8950975c

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
86386644a9472ea4e036072cc979943d

SHA1
744d40aa94eb99bddde8d3478df35af7e98ed82d

SHA256
1a6defeec8d0112fe0069708645ad0fe09531ac18a374fc35d96fb87786d0b79

SHA512
62262eca1dfb8a620a2489a75a53686216996812b915b2ff21607a39db6d3678b6c0b4161566c5c481d98262089443660728f59834e06098eb5209cb9858e732

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_webview/Web Data-journal

Filesize
1KB

MD5
74a4ead9acedef1379affe3f06d16f06

SHA1
9747027d17b03fa76fa73bbeec0c95d0a8548707

SHA256
dfeb8f6a63a1a46ee4704cbe08f7ae640f32d499bd292954158e48c42e9c3971

SHA512
35b97231a4a3b8c8562d8d0614aff5dc16f541e415fe56fb4f2c531c12d305f42f24f22251bf86f034b4efb110297fcd9ecd00b5664ada28d17c5ffda2fb0bb0

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_webview/metrics_guid

Filesize
36B

MD5
c64b933f62e372b0319f7096a87c2cbb

SHA1
c476f7d92cbd561f0c224f6d9b3284f751c72b93

SHA256
a6734ca415130c6cb0a9c599566ebd1d5ab2fd27607ea77c7c09d6913c31b359

SHA512
fbe330ee0edee7c78c6ea13f505ca7a9f339587d545ae047b4964165aa41335145fc7e069be2efc782322d88ce6bae73bda4790c2fc2f121628b3a8884c34748

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/tghqfaydexqpmsem.zxxeifzgsucaauejlhmw.zpgiowiwlipxct/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit