alienbot | 67d2f328c59f4a2866006cdd18ca81c9e3f882d585fc42b244ff397293087c44

Analysis

max time kernel
679839s
max time network
160s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
03/06/2022, 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67D2F328C59F4A2866006CDD18CA81C9E3F882D585FC42B244FF397293087C44.apk
Size

2.3MB
MD5

3efa6d294bd8115fcd1b228fbb388a44
SHA1

11440309458acdce2514b531ea1057f4a8ed04c1
SHA256

67d2f328c59f4a2866006cdd18ca81c9e3f882d585fc42b244ff397293087c44
SHA512

c4b3ff7287dc7fc7c7359c8dd8ffb4c2eb0dc39a0f5d3305aeb69225d54b0dd15272d0cdc5086bb79d18a05f22e06b48481fc8b96c55087304693551265c8075

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://ukalasey9.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json	5134	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json	5194	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/oat/x86/OO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json	5134	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf

ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5134
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/oat/x86/OO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5194

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json

Filesize
706KB

MD5
e9646addf858cb8fef1340cf602b54c5

SHA1
5b88752ec68102c6f53869c5fc528e0767a0d8f1

SHA256
4eba0bb2141a6f6d6f62e10c2f1c01ae770ab2041da4329b718c2aa2f21ce6bb

SHA512
be2dc2dfef19e265c3569211248e8ec43a69c2ee8413735f4249c55be3cc87d2163361792a15e444be890fed8563e1bf3c2576bdf80b015565bc210e11da31ad

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json

Filesize
706KB

MD5
eed7eac54814ff6acec44d5a14a1a4f9

SHA1
c80b000cc27762330e7fb7216f6dcc626675e9e7

SHA256
0242de382adfa4be23d52722eb2e8e679fa9d5475af52a546ddea08ea182b772

SHA512
4f3dfa5d653c7ce20328c950ea87b2e3fd6f03722d305cdad0ea708142131b994efccb64c3e0d51b512bd1ade0bf9ac71964f86f1644e92248da8efae57d6889

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json

Filesize
706KB

MD5
cd9be3cc70e271e1411448d4e97bfdb0

SHA1
73dfa21e3169852e2cca1727c067cf312b47944d

SHA256
24a3c1528d837ee6bec088511d693fab21490aa57618b0a67a3efa7b6beb916b

SHA512
9ec842107fc6cfc56b1efe7f034bc9faad68578625065d836da78d8d79f64c1106641dd1039147d547d93c1fda8c1c3af3829a98b9813e112a8ab915a1414149

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json

Filesize
706KB

MD5
eed7eac54814ff6acec44d5a14a1a4f9

SHA1
c80b000cc27762330e7fb7216f6dcc626675e9e7

SHA256
0242de382adfa4be23d52722eb2e8e679fa9d5475af52a546ddea08ea182b772

SHA512
4f3dfa5d653c7ce20328c950ea87b2e3fd6f03722d305cdad0ea708142131b994efccb64c3e0d51b512bd1ade0bf9ac71964f86f1644e92248da8efae57d6889

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
4a24540b16a0eddd421f52caab7c1f14

SHA1
42d6f098cc05fe0982b32ce1137a92b6d7d473e5

SHA256
153ac5323e387b71155e3cd34243c944ee1b9c9b779c9e451a0ec026e078b1f7

SHA512
1370f1b74dee701d6c5cde168250f54912c27ec9793d4778c0812f216c4b85d089af6a5db867053977b146780977a5ab707136bb0fcd2165555011368403d84e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
4a2d6cf283e713d90c7be46845d1b79e

SHA1
72ef9314170ba93f85542a5d520a27a99833feff

SHA256
e9ddabb0960e9b14e92a55574074bb3e1235a02724b573edbcfde8cbff56098b

SHA512
d5d910641cce1b1060b6610190f3cc262e2142b0d3d993d10aefddc38f190c201220e9ad838754c9132eca3c8a63567bb995438c6369a049590346294bb202bf

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/Web Data-journal

Filesize
1KB

MD5
efba1d9de7a22f3abf69e80b0f806074

SHA1
62cba207f3215f3d08a0df640dd7ddba452c357e

SHA256
767f43a751069bd2aeeae9c210e418ae6f110742778f0115f129fda08d9b1f59

SHA512
acb34508df024b255fa29ca59b58a48c7207871dc14aeebb6b89f2a08ba910762f143a225ef6dd76e706f2a088b7f9cab8cdafb4c16678c5a69d954da5773224

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_webview/metrics_guid

Filesize
36B

MD5
95976e13440accff96e25a385871dcc8

SHA1
338019ce81c4ceb3f42921b197922bc22af0109e

SHA256
6c781f01dd0912019612ebcf788970f8c10612b71bed4beadd32ac3e1496edb3

SHA512
c3c2d25755a981b200e3a6f8581605f3fc9799c6f2b0ef7962b0e33ee9701f4db9bc00b1a243aa2a3e7a12dd5f52bca9490e1cb43b58544493eee19f89b18504

Download Submit
/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit