alienbot | a4b7579bdb00a60461be39f8579e12c6b0f2c239547cedf9f18c5c6eccfbbce3

Analysis

max time kernel
615773s
max time network
154s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
02-06-2022 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

A4B7579BDB00A60461BE39F8579E12C6B0F2C239547CEDF9F18C5C6ECCFBBCE3.apk
Size

2.0MB
MD5

7b94ddbef59300a54f7d227a5a572335
SHA1

bb24108cb8f295dd9cd211ebe8c8aa704ef9a189
SHA256

a4b7579bdb00a60461be39f8579e12c6b0f2c239547cedf9f18c5c6eccfbbce3
SHA512

fff83fc7cb1cfe316ffb35e3935320c58c2dce292e0dd043227bdd68949b668c5d21b1635416ae8791eee44c31d5cdb85f786cdf8d088923626b158db4e3099b

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://ukalasey.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

izkedmghbqdztn.iinequq.xzic

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	izkedmghbqdztn.iinequq.xzic
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	izkedmghbqdztn.iinequq.xzic

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

izkedmghbqdztn.iinequq.xzic/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/oat/x86/GrgeQPO.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json	5128	izkedmghbqdztn.iinequq.xzic
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json	5162	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/oat/x86/GrgeQPO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json	5128	izkedmghbqdztn.iinequq.xzic

Removes a system notification. 1 IoCs
evasion

Processes:

izkedmghbqdztn.iinequq.xzic

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag izkedmghbqdztn.iinequq.xzic

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	izkedmghbqdztn.iinequq.xzic

izkedmghbqdztn.iinequq.xzic
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5128
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/oat/x86/GrgeQPO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5162

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json

Filesize
703KB

MD5
e1a3275cbe570a336c066169e7a8e41d

SHA1
0cc690dd678fc70fe4bbcd8cc35692442eadddd9

SHA256
3aa437b266ee4c7cea62dee32fb1f6f6ee16bdf6d07c7c66edf274f98ff96fe4

SHA512
c95e65ee415226b8c36948c50423627db75ca8aab21e5ecb0514cd1999213e9e055245e76b94b7d860f16474bc3dca783306e401d57f0b5c246562e69410a2b5

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json

Filesize
703KB

MD5
792ff833507f0ba71a3436bdb47a8bfd

SHA1
5e27205380db09df14303f23adb508854704a38f

SHA256
0780edaaadb40bb021f76f3007666e40d2c25f9c9bb4afad4fcb904e38d44da8

SHA512
e2eb8e40716d82a629ee8836392cc4415d99b73ad941ce61bfee656b24ee2c4e05923517f5ad29b296877b7902b0f675f57e72b5c3cd6071e651f69abb7213e9

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json

Filesize
703KB

MD5
a2dd2a758df4184ee219efbfb5cce16e

SHA1
4809f89ddcd0f9e0d06f09a7ce562ef0fce74c1f

SHA256
fa5175d70c32c1f1014c22849a1acfaa2bf9b2641ca616cc37b1c1157f83ef49

SHA512
bf584b3885e35f1fdd1fb786c631696ccfa98645799d87b746c0400c523e87f56db9c65248fe1a385ffa46210d9412d3875618bfeed5c56fe124cb331cf4d7fa

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json

Filesize
703KB

MD5
792ff833507f0ba71a3436bdb47a8bfd

SHA1
5e27205380db09df14303f23adb508854704a38f

SHA256
0780edaaadb40bb021f76f3007666e40d2c25f9c9bb4afad4fcb904e38d44da8

SHA512
e2eb8e40716d82a629ee8836392cc4415d99b73ad941ce61bfee656b24ee2c4e05923517f5ad29b296877b7902b0f675f57e72b5c3cd6071e651f69abb7213e9

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/oat/GrgeQPO.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/oat/x86/GrgeQPO.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/oat/x86/GrgeQPO.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
afd3799d4ec6a98463287e90b0dacba1

SHA1
2ad62ba9af52900df8d9ace316fc188ace3946be

SHA256
1d7ab2eddac0085e41c60ce93dcca39f7c52140c7c1b640e371cfc4d8f53006f

SHA512
b4f25f6a47c2d7ec32f12eec0638a9a021e12cc2e24ac04dbfcb73d2c2259408170cfed7faea897eba5e4381da17e09dd5c6b10d917ee412014d4ec1b38ee76a

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
30f43f263228ed3e8cbdfedae310c780

SHA1
92b2bae1efd6dfac6a3ceeaa91812751c5e2d672

SHA256
7dbf75dab88e18becd3ee5a588a466da9cad8c1b2068a9ca9ba551027883da7f

SHA512
bdd792373a1a593accbbcb2f094217f6ca3caf77eb296ffd66a80ed52e1fbd31aba27f8e28c161b969484296e4ba550b22208e7c09e20e48c3398ab4caec3d3b

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_webview/Web Data-journal

Filesize
1KB

MD5
2c91070b3d565cdd9492639f915aeced

SHA1
7ef3214bcd509c555b415aaf714d928f7dc3200e

SHA256
ef8e09f4825596aa4999e1045581d37e797884533e06b49abe9f75db70a171fe

SHA512
0f3a477c236c094cdd275e897212c25d8bc2405833a20aa28b9e2ef9dbc6df4c6721f4effa672f0d445c698fe161b93cd7606c65c841cb6c42c3bda3898ea5a5

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_webview/metrics_guid

Filesize
36B

MD5
9f49992f8aa708cb68c5a55b1c500216

SHA1
fb3cb0eb107ef1a914871f17ae5ebe87b8bb0a5b

SHA256
263f76e3cd187dda055f169ddcdc6d0dbbc587ead1fdb49ebba5b0267df3b55e

SHA512
817d0336f89ca8afd7df17ea10f736c3b1415704c9476a6427854537bcb0d84e3bd70fe88085376eb9325aeae3b5543a614dafc2a27e8aa8619d84d8f771eb7f

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/izkedmghbqdztn.iinequq.xzic/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit