alienbot | 9975519e1ae9ceffc6a7841b8c26fa356b98c0fd1e48df80bad49865066c28c7

Analysis

max time kernel
677580s
max time network
148s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
03-06-2022 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9975519E1AE9CEFFC6A7841B8C26FA356B98C0FD1E48DF80BAD49865066C28C7.apk
Size

2.3MB
MD5

1a3388bc2de001556f2ec1af473f8989
SHA1

d7d74bdef5b6ab2d4478cfec4e0181feb155ed45
SHA256

9975519e1ae9ceffc6a7841b8c26fa356b98c0fd1e48df80bad49865066c28c7
SHA512

419a9afdb95fa5764d0667a834e69f862eddb6301b74ec23986f688a72792fc7dc26187dff9edfc7ee791664362abbaa94196c4ed452f133623fcec8c1d50e38

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://kucsas.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/bZoFML.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/oat/x86/bZoFML.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/bZoFML.json	5331	idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/bZoFML.json	5370	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/bZoFML.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/oat/x86/bZoFML.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/bZoFML.json	5331	idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy

Removes a system notification. 1 IoCs

evasion

Processes:

idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy

idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5331
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/bZoFML.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/oat/x86/bZoFML.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5370

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/bZoFML.json

Filesize
713KB

MD5
df1e9509ced3c76f4e60f93e2fb37f81

SHA1
3f970cf2a514e7f668ae3645a41d80ead1922588

SHA256
59da792f25dbde544145c489bce848eda9d4175701aec14f2f170cbbb2829ad7

SHA512
4d6e8969ea2483558e7cd0a81d11a045750f0f7616f60fc87059ba910ccd532d0bcf8f750f43599d7e8c28f881257fddf9ff636cf35fcd021b0111114790bb9c

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/bZoFML.json

Filesize
713KB

MD5
10a784a4bf5028a5332c9abd5b25089e

SHA1
3fdbfb8baf4428fcb2dd5e126af0ba3d8c8538d4

SHA256
cea01f1b9897a2f7290f0b06c21b3d966469c813c5d59cb109eec9c0b3770513

SHA512
8d610beb95c1fd354a95c4ff6a0ed25c592d4bd79db38bc392c2b9aaefbf34b5f464b9a58d2fa6c83c704b9ef4891d4b7b6d7847dceb95f69d69dcb21989bfc4

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/bZoFML.json

Filesize
713KB

MD5
cfa3177aea1091c93c62102271c4b492

SHA1
2839895d9095d6d13f4e65855ba48c84d006b4b4

SHA256
60a17385867cb6dbca145e39a222bf521d438a590fc8c0140145c8444af84e9f

SHA512
dc797a054d328ea16695f38537b5068c6e0f48c86189722688cc695990818f0459d429c576de26b39a71b8dc71a67a0225e4678d51f14d09e1313e4f3bc2458f

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/bZoFML.json

Filesize
713KB

MD5
10a784a4bf5028a5332c9abd5b25089e

SHA1
3fdbfb8baf4428fcb2dd5e126af0ba3d8c8538d4

SHA256
cea01f1b9897a2f7290f0b06c21b3d966469c813c5d59cb109eec9c0b3770513

SHA512
8d610beb95c1fd354a95c4ff6a0ed25c592d4bd79db38bc392c2b9aaefbf34b5f464b9a58d2fa6c83c704b9ef4891d4b7b6d7847dceb95f69d69dcb21989bfc4

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/bZoFML.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/oat/bZoFML.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/oat/x86/bZoFML.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_DynamicOptDex/oat/x86/bZoFML.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
0ccaa8a16db6a81fc6ddad6dc3367dda

SHA1
b9df3f8fbec352920d2b30906dee03bbd906b61f

SHA256
8ab8670d77059c7e653be677a803324d8a639b0421014f71e9913f30b60c51ed

SHA512
b00d9671327c4a442df8e14c974aaa6a1580e06694d46c45fd8b362a4d40fc91a11a0b67b54e4c75b36fbb411b38612c023370e1c45c06631432961d08da120e

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
f112659518d8494a576d790d3a609d5c

SHA1
ae515e3a1257b979e0953df62c62ab1c2398ef29

SHA256
5043617ef29261579631a5ebbc944975a56fb30fba9ee3c85dd6aaae7fb9a2c8

SHA512
668f97fbdd6d88c4a544a961d991b27122f31bca81554c9922957c8bf1b76fde81b6900eaea165d4ae1de58bfaba3e788de7405231349aab7d854c8d2cc1e085

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_webview/Web Data-journal

Filesize
1KB

MD5
39ad2f3cabc07e0f5a1230abc97490a2

SHA1
6dcaf2c536426d42b679685399eca96377df8dca

SHA256
411a2c139c398433da568aaa7c16781317f4ba50996723807b88fd843fd30e06

SHA512
e6ab18680a522b87c302305b9fef5d93815f8740fb70ba2cc40c3d5b3c73317e0091133213af037390b1258ece28cf82a84dabcd4277817ba3bce1c607f7f1dc

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_webview/metrics_guid

Filesize
36B

MD5
082872c13b1c63cc0556c4ac2800c714

SHA1
7ee32667e3478304f91fc750475fa3647a8c65a2

SHA256
ecf908470778b8e0186529417dd1abd895a45c7c960cb427b680c7fa46a901ad

SHA512
01b9cf8ffd69fc558d2a368f1a36227ae8ef4a4d46f4b43b6285c97dd03de898c2069a466c09a10e8448ae5eb53bff128b06a7885f09643336a039927ff52c63

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit