alienbot | b6e38b5e6d52ff61e8d933a9d67cf0e25cc3c58d55c66efda186a5f896b45b67

Analysis

max time kernel
680818s
max time network
149s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
03/06/2022, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

B6E38B5E6D52FF61E8D933A9D67CF0E25CC3C58D55C66EFDA186A5F896B45B67.apk
Size

1.8MB
MD5

5c2ecef11891d1c63d4ca92fccb4e7c5
SHA1

6b31aaca8276cb95de2892cdd580172c701533aa
SHA256

b6e38b5e6d52ff61e8d933a9d67cf0e25cc3c58d55c66efda186a5f896b45b67
SHA512

63984397f3e32bacd4e3bb46eab3e8e8a5a562be2e68e0e0179197d89c6c02abc714f929be02be2ee2789c17e0790e9221f46dcade5e88bc967446fd912fe0b1

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://malimaskim.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_DynamicOptDex/ASmk.json	5309	xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz
/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_DynamicOptDex/ASmk.json	5379	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_DynamicOptDex/ASmk.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_DynamicOptDex/oat/x86/ASmk.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_DynamicOptDex/ASmk.json	5309	xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz

xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5309
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_DynamicOptDex/ASmk.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_DynamicOptDex/oat/x86/ASmk.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5379

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_DynamicOptDex/ASmk.json

Filesize
677KB

MD5
e57081c0691933d4f5a1fb07be2b88bd

SHA1
31499beb9d78943564d5dd48ee6a8e1112b8c68b

SHA256
acd45fe80167b23dcf4064a59a7d927c4afb9845c9ca981790896acfe6da1239

SHA512
190de8a8895da04346d9142c19d38da9fac60924ad4b529e966ed8b9514ac65f8490ebfcdd2de20659b80a9d0d4423c51a559a2e1afb59fa24ba1fc9860d32d6

Download Submit
/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_DynamicOptDex/ASmk.json

Filesize
677KB

MD5
b54867a1b40e64cdd9628033113301c9

SHA1
69d0ab0910d7c354ab6ef25a8bfcfac978727132

SHA256
5e92fc2dec68e4cb611fb515b41cc75f61e977a9f02499410c9f783a454d604e

SHA512
b1f9c1a7840f5790a11bd801c15f0d0b5fd7bd07f6a5109ee2e6782bbb91f0b6d03891ab9442a6a9e877b5ea1c8ce60e596578b07397ab081d5ded982f553e0f

Download Submit
/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_DynamicOptDex/ASmk.json

Filesize
677KB

MD5
163827187c15855e668119ce1d196395

SHA1
add030f50bde977b1b8638f472107068aefa9abf

SHA256
e1570c6fd72bbd80ef02110d3570b028fc8eb611faf73c2055dccfa9bdf7d06d

SHA512
f7143ace55ba7e369af856688118ed1ee722a104d8c9f09459c3c1c9f4d9ce7a119059f7be8c7fdcdbd4c9834bdbf55930732cd7a2670fb0a624c2fcf85714b4

Download Submit
/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_DynamicOptDex/ASmk.json

Filesize
677KB

MD5
b54867a1b40e64cdd9628033113301c9

SHA1
69d0ab0910d7c354ab6ef25a8bfcfac978727132

SHA256
5e92fc2dec68e4cb611fb515b41cc75f61e977a9f02499410c9f783a454d604e

SHA512
b1f9c1a7840f5790a11bd801c15f0d0b5fd7bd07f6a5109ee2e6782bbb91f0b6d03891ab9442a6a9e877b5ea1c8ce60e596578b07397ab081d5ded982f553e0f

Download Submit
/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
32c3a009e32b7ce72ec464fea4947d31

SHA1
5e49191913885070447eafdd7b634c1fde94842f

SHA256
66eaa418cad97c1ba63c49c21d7072afc6336edfc5a51f53b1eb8d3d396c6872

SHA512
db785c2ffeb28baf92172303995e0007004568aab6d13e107f80ce5f4ff80acd6b081ef46a48a794b45f786cf0ad96d1877eeb8056b05da406006d6c5693fcf7

Download Submit
/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_webview/Web Data-journal

Filesize
1KB

MD5
b90ca76c9b2fa1e08b0404068004df7d

SHA1
e6fa3fa4ee91339507a92153ed9154bf5db5d888

SHA256
a9a6c36738627aa45eb69b8178fba3338941bc68e4a69475cdb0300d158945a0

SHA512
ecdd59776c6ec8abc8fcbc44f43b905162c3ecff0bd9b309af572fe83912f5cba1b1c8cfbeacdf33aa240a1d2207a9a31e34d85333585450226751fec936e599

Download Submit
/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/app_webview/metrics_guid

Filesize
36B

MD5
21c6915fb896d1091ada167168767264

SHA1
9b0b006907ab262cf856ea94b47f6339c1f8f78a

SHA256
82c57e68daa4ed4bc76456519c37bc0a247410c2fe1c3babecd37f729e2bcee5

SHA512
94aa99c5bd1b03ebd37f70cfe78862c49413674089ebee2ac4526e601648d1206b07ddcccea7017b12fb7d4c71d31c5e1d516ef7c800f8e57a324b2d5f338ce4

Download Submit
/data/user/0/xuep.rsxnmdsrfzsyshmotuxbiieexi.nlqzuxnjzhjnujcmryqz/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit