alienbot | 3260f9f19cefb766f7c303bc221b37fea75692943231f4399b95588ce968816c

Analysis

max time kernel
612221s
max time network
150s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
02/06/2022, 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3260F9F19CEFB766F7C303BC221B37FEA75692943231F4399B95588CE968816C.apk
Size

1.9MB
MD5

ec009b2f303451aeda939162e5b2940e
SHA1

c0926509614062e1acc306059967c36652ff06c8
SHA256

3260f9f19cefb766f7c303bc221b37fea75692943231f4399b95588ce968816c
SHA512

837fa7718ae06f2b2bed407448cf66a5b5bae47c15834d89d876e23b93f4b14a4566b20889c0549deea7151219753e8ab6b4d0be73a649147f7d992725823bae

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://zesasar11.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_DynamicOptDex/bxKCP.json	5167	zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx
/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_DynamicOptDex/bxKCP.json	5199	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_DynamicOptDex/bxKCP.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_DynamicOptDex/oat/x86/bxKCP.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_DynamicOptDex/bxKCP.json	5167	zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx

zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5167
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_DynamicOptDex/bxKCP.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_DynamicOptDex/oat/x86/bxKCP.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5199

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_DynamicOptDex/bxKCP.json

Filesize
704KB

MD5
c302b281b853eec27b21d100fff8912c

SHA1
a38b651fea1f3bd872c40aef07a34ab0e7dd2fd6

SHA256
390e97850c335ac3b910ff9b96f68680413d095c713808afce2d715386aab896

SHA512
a700b304b12d59dfd50ab9e9ce36163c583bb0df4904fc25d9f49bb2ee8a15971b119da756134fe733091de136e16d824c1a76313124a8dce4dbf39f5cd7542b

Download Submit
/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_DynamicOptDex/bxKCP.json

Filesize
704KB

MD5
adf3a15f3032cb05002bfae10d99ff58

SHA1
61339048eaacad55ff9a509daff0377c1de661b9

SHA256
3eb0d9ca4472b1817dc4abf04e2341354b57437a0afa0c1e39edad877b32a8e6

SHA512
323adc7c8b64094f49e1bb36276fdbf1366b4d3f9ee69fd38d523bff90ccf537a23c8013e0503ea5295dc8a7558ef7b6b71ebf9af677b9b55ca4cacef123026a

Download Submit
/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_DynamicOptDex/bxKCP.json

Filesize
704KB

MD5
c1e22e88326cefe9b7a28042ec609b76

SHA1
991d00d9de56f0b1076e1d9fdd494924840de69e

SHA256
ec8b6fb96b440d4b8886a06f77a603255a34448ef58bad22374160bcebfb9d3c

SHA512
8d39737bedb6714e3f89ce078830a15252e977e4a212115bd11bafbcc80b84f7f348d849721dcb1ed85c731ee5ac5dc01ae299219ea4b675814e98082edcde22

Download Submit
/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_DynamicOptDex/bxKCP.json

Filesize
704KB

MD5
adf3a15f3032cb05002bfae10d99ff58

SHA1
61339048eaacad55ff9a509daff0377c1de661b9

SHA256
3eb0d9ca4472b1817dc4abf04e2341354b57437a0afa0c1e39edad877b32a8e6

SHA512
323adc7c8b64094f49e1bb36276fdbf1366b4d3f9ee69fd38d523bff90ccf537a23c8013e0503ea5295dc8a7558ef7b6b71ebf9af677b9b55ca4cacef123026a

Download Submit
/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
cac1ce876e746b7a933de49412dbf237

SHA1
d788171550df615b654719a2a28c5cd1145d8cd3

SHA256
405bde95734f73aa210aab77c8fd7f347cd23ce023a37fcd26ff7d041a8c3a32

SHA512
e0a1adecf83633d31a436ae940d4035487c3e3721078087852c05d438eeb865c223da3d5f5ba4d2955e1b9f05f7635d43866afefd590120da8b2daa21d4f12af

Download Submit
/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_webview/Web Data-journal

Filesize
1KB

MD5
e88281ce1b40a556f8f8bfe08fd42709

SHA1
4693d4fd60a0d51682d4c103fe99598593e55c11

SHA256
d6a6b86284a27f0b97697e28b60be3c6a39b2bb6a19661981886e82de1135441

SHA512
03b355380e45e47a21edad5331e015abee1ade10c2358c1a77d48efd04c031643d4c4c3aed37c2fb2fdeab307cd062de5c40136cc6ed57fd8cc945a5ec27106d

Download Submit
/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/app_webview/metrics_guid

Filesize
36B

MD5
ce735ab7e3c01496abc335e62478ba92

SHA1
b529351db2916eff9db21a798a685548d941d752

SHA256
fcdc3ba83d3a1731bd788684fe19a23fb9dc1657d49d6bf8798663a76c2d8210

SHA512
5880ba0cc6154dc3072f61e297fe7f294b8fa00b2c674d5be9d472e1d011b54d571501daed9d5db188a92ce77e01efcb0734f4cedfa2a4e80e286735df889f52

Download Submit
/data/user/0/zogbihyeoojalbkxzuoiyh.gaazzbeqam.jadsgxuwbblx/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit