alienbot | 416b8132857e150bbb4b8dab7ffe94d28d13c485efeb54afe2e58ccca7361d42

Analysis

max time kernel
676575s
max time network
162s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
03/06/2022, 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

416B8132857E150BBB4B8DAB7FFE94D28D13C485EFEB54AFE2E58CCCA7361D42.apk
Size

2.4MB
MD5

f065d7db0a94da8f2556f094245baf21
SHA1

45ec5c68a522c1f8806a0b467fb8a89bb0fc57e9
SHA256

416b8132857e150bbb4b8dab7ffe94d28d13c485efeb54afe2e58ccca7361d42
SHA512

9b3e0e85fb6a2db82d8d16b17756b02367cd64e85cd4a3d3f569c60719ed61f4f4cfe010186473819a617e3d6a5ba678093af24dbc3152eb1a2c9a2105aaab8b

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://kucsas2.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json	5298	ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json	5354	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/oat/x86/jw.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json	5298	ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd

ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5298
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/oat/x86/jw.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5354

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json

Filesize
610KB

MD5
04ba0b0fe366b58c33e7d13d757ce320

SHA1
2412a790bcec41d7fc1ff2ad7f16e50938fe56df

SHA256
c0d92b5532c8e216d6ec94d552343839797e5a56c3a204e8a845ea5c5c5e1cdf

SHA512
00508b7df303d2e6ceeaf4f7c4fbfe9ff4c512da515f5d67fb3d89b51f291df4c0809bd9f3231bbed7628975f63c699f3311bc107ce331d52d80e4e975e771e7

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json

Filesize
610KB

MD5
bf063aa2119c8a4dc6f3cc781ffed21a

SHA1
7cacf797b5e7f6e94ddb1920f38095fbeaca02dc

SHA256
4a2a9a37989ad92b6e1c31d4f5d10769ac4e870a4ab3ab189ba90360121ce07d

SHA512
088df9cacbbbe8741793c08ef0ceaba94483176de53740c45fb9970782eaf9dcd7465686e9e1233ddd408f0726336789872a6224f4cf16d62fed8b94b566ae69

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json

Filesize
610KB

MD5
921b2019cfa61bb9f1a449d3498ccc03

SHA1
00c2b251ac49c59c13029257240ab6792e509a70

SHA256
b0c06be6f842973e8800e274071ebdb9f30f3520b9327dd7843af0164af232c7

SHA512
6b6169f3462acc0a60608c4d69f33a3e6b4823c3dfa06ad8d677751c23af09d561762b7dc7bad74ef228291b17eb2f2529e51f6d1724f1fa53bff74857133f09

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_DynamicOptDex/jw.json

Filesize
610KB

MD5
bf063aa2119c8a4dc6f3cc781ffed21a

SHA1
7cacf797b5e7f6e94ddb1920f38095fbeaca02dc

SHA256
4a2a9a37989ad92b6e1c31d4f5d10769ac4e870a4ab3ab189ba90360121ce07d

SHA512
088df9cacbbbe8741793c08ef0ceaba94483176de53740c45fb9970782eaf9dcd7465686e9e1233ddd408f0726336789872a6224f4cf16d62fed8b94b566ae69

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
e3d4a229eeff69ee23f67e2afa3f1ed2

SHA1
4b97dc3a3f8d77de98c615a35d43f30133299c44

SHA256
48074b53a9e028ca7e8c0faba2caef158aa9938d98290098eb3db5f2381ea44a

SHA512
2797da045090a9a67aa738cf97282a85840470bfd84170b7ebe8ca11ec7c3c578cee40a28b28620ebe85e51eb2a09fcaa2d28e805d353758d6a571eba43a2f19

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
e8427aa95585c30a131acee9ce62a7dd

SHA1
b402936f3ec38e771bf028b4d67e4eebb581014a

SHA256
4f2ae87cd3adfe08556d5ce9133076c8b029c6c6f8404d0ca83ef86146949f76

SHA512
72ec77543e468e6a80ce396644f50f5598c4ff11004e013422591fa1ecd10b49139c52b3b3cc79a752460e48d149b2484a0bff4be3eabdbc3227a982f73fb684

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/Web Data-journal

Filesize
1KB

MD5
4d70b1a47c5815e32d4193c719da262d

SHA1
996e6928f8b4101891e127c8f4f72f3392bbda6c

SHA256
f1fa2fc84d4b3b80356b2799dadd4016b257ee283b0737572f433270e8395502

SHA512
0c2fec51b7de03dd313ec40b9f6fcac2fe76050ec1c3b419656ab6a49f5136ce439ffce7d2f6f8957e352a96332384beb5feccb483ca62157eadb483138db57a

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/app_webview/metrics_guid

Filesize
36B

MD5
4aa9963e12b2eddab490caf2f5b97b8d

SHA1
03a13469fe732603895c3ba2224ff800783722ac

SHA256
ecdc9cee67f1c3480660d6e58095df0f7f6b4d19fd58fde8258dc884b98478e2

SHA512
123fd346c5dba78fcb96fa036319d5a849025021e0f7946d5f45e6087a73e87e8cd441cefff7af0597efa7dd1c9c665d5b63e1a7a038b65e610afebc915f5a6e

Download Submit
/data/user/0/ulslbqm.pzsnyylkjuhkhpctscfjwntn.ssdsweseezd/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit