alienbot | 32376baf8d01ab49e8a4b35ec35bc27fab99b66bcefcb160a7878e724d68bc3d

Analysis

max time kernel
677376s
max time network
156s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
03-06-2022 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32376BAF8D01AB49E8A4B35EC35BC27FAB99B66BCEFCB160A7878E724D68BC3D.apk
Size

1.8MB
MD5

e07dd64ed4031f2335f378c3c8a92ad4
SHA1

b5a40dcc077c4fe6c6b124a11d429d6fbd403184
SHA256

32376baf8d01ab49e8a4b35ec35bc27fab99b66bcefcb160a7878e724d68bc3d
SHA512

25f3e93d5f4508549600e8da98d124431efc97f80101bf888100c9722beae4d025b77a8af93d75cd1091030e0ad81d46e3d6eb6b306328686f2122ff10aeccc3

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://cacecarsa4.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/AQXC.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/oat/x86/AQXC.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/AQXC.json	5111	ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/AQXC.json	5193	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/AQXC.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/oat/x86/AQXC.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/AQXC.json	5111	ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea

Removes a system notification. 1 IoCs

evasion

Processes:

ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea

ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5111
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/AQXC.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/oat/x86/AQXC.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5193

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/AQXC.json

Filesize
767KB

MD5
b8f550490a6a7cdb785312379bcb8580

SHA1
da3317c21a9b20aecc5a817d3311dbc7d4621c50

SHA256
81f9b2c596316ab91e30896d51a1c39e8d9ce38a903579f44b57289354ebd9bc

SHA512
f5f16f55490e6839801197cae3947266a63d0c67c120049f4e759a0d5dae85b9184c64f7e5194232c3a96ae3dda408fd92457bca3e6f85407d21ccbb2dc73249

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/AQXC.json

Filesize
767KB

MD5
4ed3407ee5506b487ccc84536e4d40fd

SHA1
f31c979d8d68390196d5520416483bd0e8c30138

SHA256
c0349fc15d53c193dbe06f698e96192919bcb00c7f83cf35fb8c1fec4a2ac887

SHA512
dcbe67d6fda298fea336fc87ca9649c63f776a042ba24028d7a11ad7dc8c1b853bdc6439264d72fc2439d0e66584ad8ab8cc1aea9dc87be0fc407202dc9f701c

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/AQXC.json

Filesize
767KB

MD5
a2fa8abefd5c669b2a486402b8d08bf6

SHA1
9c24f6919011abf6a1bd18d1f2ef47a7dba927e8

SHA256
7eb1c347eb24f3ed70ef934b03849ce979f17b7193091538cca8369a3dcfee4d

SHA512
ed5f77802274471593899cbbf52ab9dfca74b5dcbc07912b2908a4418438a2c0aeca95c4043d5c155027724293999f233cef3d23cd8d1b9bc535bb5bae37e47f

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/AQXC.json

Filesize
767KB

MD5
4ed3407ee5506b487ccc84536e4d40fd

SHA1
f31c979d8d68390196d5520416483bd0e8c30138

SHA256
c0349fc15d53c193dbe06f698e96192919bcb00c7f83cf35fb8c1fec4a2ac887

SHA512
dcbe67d6fda298fea336fc87ca9649c63f776a042ba24028d7a11ad7dc8c1b853bdc6439264d72fc2439d0e66584ad8ab8cc1aea9dc87be0fc407202dc9f701c

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/AQXC.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/oat/AQXC.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/oat/x86/AQXC.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/oat/x86/AQXC.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
000ab90070b6bdd1a186ea86772bda7a

SHA1
d0fd1b99f2f3716a422ad0757e48f095294179f9

SHA256
05f7901dc2abddbb068893fcdaf958e2e8c05b21231c9800c25ecb7f99bea287

SHA512
97f428ab62405c21c77ff64997b3068aedfa89c077997eb8e7a0c20104cf21310ceccc92d3ac7494db194476e0b4791dddf0159ad326810ff65d69c70db91f7e

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
fd930f861b768ebb44181e32e184a5ce

SHA1
e3082334f42364177a10c9eb838ebb1535ed4df1

SHA256
b5dd08301cd9280c68e117957b59529724f36185b984e016b73189e8510a9f95

SHA512
55fce109d759e35df11f06d1a64cb131051140865c15e35604039b5ba87872a17d639630910ae48cc6bacb259be82d701152e04ec3182afbf02518295fddbf16

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_webview/Web Data-journal

Filesize
1KB

MD5
fb14cbd0bcee1dfd4fd99e0e005e656b

SHA1
640a5799a297315735c8f163d37e3797c2774c48

SHA256
532f5808046d0d4edeb3509b3fe4e8c9939526a5c820a1649f294cdca7d85bd0

SHA512
32182f3e2207d1f47da8dbd6666722e56846ba6fca7eea00d92d3cca10090ef04f2b7e7343eb62da215fb14a4a21c985395395956301e4884613c92a431f13fd

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_webview/metrics_guid

Filesize
36B

MD5
935e06318f95f2128acfe9e5a6eac394

SHA1
9303c50dc5cdc36ce9d14ba555c33512abf4b835

SHA256
4b39601c4381a918403d0b487738c0a6ec244f5f88435dfcb6836ca3f6132e2c

SHA512
75b379a4e1f9c01e6b1541aefe4f7f0475c5003a8e78fb91d2badafa12b510b5f06fbece31f7b11e1541ccdf38fa466a9c9f4928084975912e3db809127c5198

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit