alienbot | fe23b30a9296477557f027d4710e81eb1b08d65a1a83b6d81a4ed6128ed6e2a0

General

Target

FE23B30A9296477557F027D4710E81EB1B08D65A1A83B6D81A4ED6128ED6E2A0.apk
Size

1.5MB
MD5

b8328a55e1c340c1b4c7ca622ad79649
SHA1

fcc39b953d047b4cc9e553e0b28ce5410b4f5244
SHA256

fe23b30a9296477557f027d4710e81eb1b08d65a1a83b6d81a4ed6128ed6e2a0
SHA512

1ab9ce5bdc0ea49b1f3d023954388d3e97e09820a6ec438fd422c613167bbd6bd0fb4ebae109e94331776d29149dcca938353bb0f567a80ebd401c87e88849cf

Score

10^/10

alienbot banker infostealer trojan

Malware Config

Extracted

Family

alienbot

C2

http://kryll.ug

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

hdjro.nzaqrgffealnhmorwihd.mfukiybfx

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hdjro.nzaqrgffealnhmorwihd.mfukiybfx
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	hdjro.nzaqrgffealnhmorwihd.mfukiybfx

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

hdjro.nzaqrgffealnhmorwihd.mfukiybfx

ioc	pid	process
/data/user/0/hdjro.nzaqrgffealnhmorwihd.mfukiybfx/app_DynamicOptDex/ZE.json	6901	hdjro.nzaqrgffealnhmorwihd.mfukiybfx
/data/user/0/hdjro.nzaqrgffealnhmorwihd.mfukiybfx/app_DynamicOptDex/ZE.json	6901	hdjro.nzaqrgffealnhmorwihd.mfukiybfx

hdjro.nzaqrgffealnhmorwihd.mfukiybfx
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:6901
- getprop ro.miui.ui.version.name
  2⤵
  PID:7082
- getprop ro.miui.ui.version.name
  2⤵
  PID:7201
- getprop ro.miui.ui.version.name
  2⤵
  PID:7234
- getprop ro.miui.ui.version.name
  2⤵
  PID:7259
- getprop ro.miui.ui.version.name
  2⤵
  PID:7287
- getprop ro.miui.ui.version.name
  2⤵
  PID:7316
- getprop ro.miui.ui.version.name
  2⤵
  PID:7353
- getprop ro.miui.ui.version.name
  2⤵
  PID:7382
- getprop ro.miui.ui.version.name
  2⤵
  PID:7407
- getprop ro.miui.ui.version.name
  2⤵
  PID:7427
- getprop ro.miui.ui.version.name
  2⤵
  PID:7450
- getprop ro.miui.ui.version.name
  2⤵
  PID:7477
- getprop ro.miui.ui.version.name
  2⤵
  PID:7501
- getprop ro.miui.ui.version.name
  2⤵
  PID:7529
- getprop ro.miui.ui.version.name
  2⤵
  PID:7554
- getprop ro.miui.ui.version.name
  2⤵
  PID:7594

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/hdjro.nzaqrgffealnhmorwihd.mfukiybfx/app_DynamicOptDex/ZE.json

Filesize
774KB

MD5
2db9448a09e5ed5aae287bbbb541057b

SHA1
ca0d5fdad470b52c82080b1f6e27a25a6e0f5aa7

SHA256
0cbbae3152607da974a7bd7858d16dba730eaefcbe4b8a3ab5ee0ff4aa9ec068

SHA512
bbe3c4d7f6cab901d3e0658dea4b2efec0504670656643e1bf36d3ee691bff8a50bebed33f7dc08631ad9fa46402d7b785a8913986a727b57cb87671ac62d357

Download Submit
/data/user/0/hdjro.nzaqrgffealnhmorwihd.mfukiybfx/app_DynamicOptDex/ZE.json

Filesize
774KB

MD5
ba6f86b43c9d0a34cfaac67f933146d6

SHA1
efd9b877345c9e8185a3dd49886068807c830632

SHA256
f943d6ec087bd9b7447bda11ccf88e511572cfbc6e977c19095788cc51087075

SHA512
dc3da533a0cdac582c966aa173fd9da12b69ee57b151d7d05ef96070fa9e3481570674d8dda00c299cc5d162d8747eeb55181b289a48c0f420329c89e5d0b43c

Download Submit
/data/user/0/hdjro.nzaqrgffealnhmorwihd.mfukiybfx/app_DynamicOptDex/ZE.json

Filesize
774KB

MD5
ba6f86b43c9d0a34cfaac67f933146d6

SHA1
efd9b877345c9e8185a3dd49886068807c830632

SHA256
f943d6ec087bd9b7447bda11ccf88e511572cfbc6e977c19095788cc51087075

SHA512
dc3da533a0cdac582c966aa173fd9da12b69ee57b151d7d05ef96070fa9e3481570674d8dda00c299cc5d162d8747eeb55181b289a48c0f420329c89e5d0b43c

Download Submit
/data/user/0/hdjro.nzaqrgffealnhmorwihd.mfukiybfx/app_DynamicOptDex/oat/ZE.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing