alienbot | 486afd2192aa17f4e95da012b549ab70cf2d250a6e7a12210010a6c413c7e2ae

Analysis

max time kernel
614025s
max time network
158s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
02-06-2022 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

486AFD2192AA17F4E95DA012B549AB70CF2D250A6E7A12210010A6C413C7E2AE.apk
Size

306KB
MD5

63c10ff97b867eade1b841963801b662
SHA1

33062f6c1bcc468bf4a51296b8eeb08fb1a2a03e
SHA256

486afd2192aa17f4e95da012b549ab70cf2d250a6e7a12210010a6c413c7e2ae
SHA512

ec73125fea196e2360472e9f7789ba613638ed35780bfc8c697e02037293f96b1f91000693d6a91a4946997c9d6ae883e99486c46ab31bde43775cb7191d66cd

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://zesasar8.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.ilcyoqlbbgnsetby.vfzfnnzrc

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ilcyoqlbbgnsetby.vfzfnnzrc
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ilcyoqlbbgnsetby.vfzfnnzrc

Removes a system notification. 1 IoCs

evasion

Processes:

com.ilcyoqlbbgnsetby.vfzfnnzrc

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.ilcyoqlbbgnsetby.vfzfnnzrc

com.ilcyoqlbbgnsetby.vfzfnnzrc
1⤵
- Makes use of the framework's Accessibility service.
- Removes a system notification.
PID:5071

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ilcyoqlbbgnsetby.vfzfnnzrc/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.ilcyoqlbbgnsetby.vfzfnnzrc/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
bcd10bbeab9a0dacb25207e8cecfc8e4

SHA1
e22194bbf5e76f53621f4d54006e4ff4aecf9a12

SHA256
32319f0b122ceb3a4c1f663e5a961484591350cee8fe4bfcf94cf4c413213a99

SHA512
f48f44b4b04787048d5b7c7bf3eda4d3894b5fa4545349bac4df3fbf60fd85a5e0caf2f8e1e7686008049106b1e1616ffb46b21492f6fec4fa3081f185868a1d

Download Submit
/data/user/0/com.ilcyoqlbbgnsetby.vfzfnnzrc/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.ilcyoqlbbgnsetby.vfzfnnzrc/app_webview/Web Data-journal

Filesize
1KB

MD5
b86678280f2ae4796c1ccc7509dd6a9a

SHA1
27d85019d97293f15e9e41bfec2620b08c204f3f

SHA256
09355c20ed5f490396fb18721f399f841f734dcdb8a0657f7d5cd7fbc283d6be

SHA512
c203f4f14076543fc50b503a58205ececbec41b447f9c1eb9dcc11d588f11e4a2404894cddf203795d6448eb378e48e2237611687454ef5094448410f34bd9af

Download Submit
/data/user/0/com.ilcyoqlbbgnsetby.vfzfnnzrc/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.ilcyoqlbbgnsetby.vfzfnnzrc/app_webview/metrics_guid

Filesize
36B

MD5
d06963516f33ace1228bf84a6337998d

SHA1
020a9da3c44ee4e0b733d3c72f5a6f9b09bd1090

SHA256
1937fbc51f005ffbecfe7cfdb2b1191b9f8dea0ba08e5e2efd58a0e54365f4e3

SHA512
088edf244d793b178249a7e993c3a53bdc5cf5e271ad006b373b56db266718afda0432825f9e686afd310afeda22f0384c8c4138236dcbd26c311be2bb0ee1a0

Download Submit
/data/user/0/com.ilcyoqlbbgnsetby.vfzfnnzrc/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.ilcyoqlbbgnsetby.vfzfnnzrc/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.ilcyoqlbbgnsetby.vfzfnnzrc/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.ilcyoqlbbgnsetby.vfzfnnzrc/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit