alienbot | bbf104dd9bfef77855eaf4f33e4c62c8ca7cf7d7b26c4c2745098a5e198dbaa2

Analysis

max time kernel
612009s
max time network
160s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
02/06/2022, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BBF104DD9BFEF77855EAF4F33E4C62C8CA7CF7D7B26C4C2745098A5E198DBAA2.apk
Size

1.9MB
MD5

53184189e7286f3f273938fe05d429c1
SHA1

a2160cfd87827a1650077def9dadc5f3e5b8bb2c
SHA256

bbf104dd9bfef77855eaf4f33e4c62c8ca7cf7d7b26c4c2745098a5e198dbaa2
SHA512

c9240dc01df598b2ae78fd991f0b715ddb866bf79d5c1fcb908033e2d7ccaa12fc6933c519948b685657ed5f64b2e1e154b57c82e3dbd622f090594402dca98c

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://zesasar11.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_DynamicOptDex/KstoRXf.json	5347	atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut
/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_DynamicOptDex/KstoRXf.json	5376	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_DynamicOptDex/KstoRXf.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_DynamicOptDex/oat/x86/KstoRXf.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_DynamicOptDex/KstoRXf.json	5347	atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut

atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5347
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_DynamicOptDex/KstoRXf.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_DynamicOptDex/oat/x86/KstoRXf.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_DynamicOptDex/KstoRXf.json

Filesize
666KB

MD5
1ce53fa73d6862065e039e8b51f89d02

SHA1
41c32366c5e697af632dd8617cc0ca14241cf774

SHA256
dfa6cbb4338229fbf5de0a6083c555b04e509477876c113e907ca0814e19531e

SHA512
014f63059a5a69f60d3220ef3b9156beee9190da128b110064fa3a553f3d1d3bfeef948795fda77a4994b14c85cefdd557504c156ef8e213aabda22d5c0ac057

Download Submit
/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_DynamicOptDex/KstoRXf.json

Filesize
666KB

MD5
a26eb7651d6f1891cb3bd9cbfb1cd52d

SHA1
12f21e7398fcc9e4b59f0859ceb9279688ef9962

SHA256
d8c42308826b566437df0c959c05630f2a113af23d28e35aeaa26eb6574ff2d7

SHA512
3947df5f6e91b68d3dd3c59742b61788f2472a601768f858f89e42fbf090a8bec7de54f0e553a0dd678f034605b2e436b9f0a0b410926a99aebc83d0094e8c7b

Download Submit
/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_DynamicOptDex/KstoRXf.json

Filesize
666KB

MD5
65e60cc534650590640a37ec63f1c820

SHA1
70c758ded5429b26965a81dca4138843d738d099

SHA256
af34253d953423644dd21a1ad513295036368ba32758947ead79f670a386a223

SHA512
5e78aaf80d5a78fa851d4e19b29b5c6a523010698ef7a3daba1e1ca56d1334fe353538e50056f3704d715fcfe785f5a3b1d080cf6d8e2d510aff60450cd17d03

Download Submit
/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_DynamicOptDex/KstoRXf.json

Filesize
666KB

MD5
a26eb7651d6f1891cb3bd9cbfb1cd52d

SHA1
12f21e7398fcc9e4b59f0859ceb9279688ef9962

SHA256
d8c42308826b566437df0c959c05630f2a113af23d28e35aeaa26eb6574ff2d7

SHA512
3947df5f6e91b68d3dd3c59742b61788f2472a601768f858f89e42fbf090a8bec7de54f0e553a0dd678f034605b2e436b9f0a0b410926a99aebc83d0094e8c7b

Download Submit
/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
7c28c81c8ef7fb0de9ab47fe94439f6a

SHA1
a2902df94faf940a48777241c6897dca7ed2010c

SHA256
d7aa7a9b97af08bea910e3675b9bcfbba036e9814290ddf0f38e648930e0c197

SHA512
57bd9847a63d5056f8155f7eeec0ca244d3e32e3c24704798552372e2ac17bc3868dd2b13ffb3fac6439987ae285bfda3b51788dbba3405162e7cdc0d4697eb9

Download Submit
/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_webview/Web Data-journal

Filesize
1KB

MD5
7063a6f2bba939b6adcc92fad844c200

SHA1
ca1d7d4af85cd254ba1eb3a451fc25cd82ab5a0b

SHA256
814db3b4b87ba5f4e2601cf7aee070a464c2d87f1f9703e95c813041b3ec04c1

SHA512
cc68607fdce0af583b84b645ab9e6e6528a49abfbe2d1d829ac12584c1e897a700417ae7acf8f47d3ed0bc65840344f0da51e12e7e62fbed9fe4f4330acdcd9f

Download Submit
/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/app_webview/metrics_guid

Filesize
36B

MD5
5fc4c80f5099615aa9a1b4642d8b27b6

SHA1
10ce8a7dfcc894da19b55697959eebf06922201d

SHA256
e74693408c40f844ac8d1345e7b524ed1f67279ea30e610326be41ed744c0bab

SHA512
faa2551387863d7dc2b6d69eb2dc753c07b12cdf4646b09bf243cbd6df46a494e2c5646dacb8824e14b550cb6da5878958dcf1d58647203e9b633c4b0bb88237

Download Submit
/data/user/0/atncfdltwmhqcftnoglm.eefwtmeqytgycysisngrfzsqw.bqeymhocpptut/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit