alienbot | 3549cea95ec003eed01fdea693f160ec73d2d3c455544557a0c8b98969f1551c

Analysis

max time kernel
677705s
max time network
161s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
03/06/2022, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3549CEA95EC003EED01FDEA693F160EC73D2D3C455544557A0C8B98969F1551C.apk
Size

1.8MB
MD5

2c791cd2cc562ea19b946b2ec6821a8c
SHA1

67cf7df79337555fa27118f9a749da843422c315
SHA256

3549cea95ec003eed01fdea693f160ec73d2d3c455544557a0c8b98969f1551c
SHA512

f938a706ce332104842532e8b0b1867828dd8d6848a01a5bfcc41c4f84a24e766e6dc3504b2c3db8221830bbd051b7aea45ba8eee64bb411446d0ab45d60d5f3

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://kamuranipisapa12.site

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_DynamicOptDex/TLqrS.json	5300	zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj
/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_DynamicOptDex/TLqrS.json	5327	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_DynamicOptDex/TLqrS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_DynamicOptDex/oat/x86/TLqrS.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_DynamicOptDex/TLqrS.json	5300	zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj

zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5300
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_DynamicOptDex/TLqrS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_DynamicOptDex/oat/x86/TLqrS.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5327

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_DynamicOptDex/TLqrS.json

Filesize
598KB

MD5
6d702b63addb2220356b62e86ab17aae

SHA1
612ab3e0ab2121cbf326319e437c2caf9be8c749

SHA256
f6354a541c2fd70f6f0b88347429d38d8e9fb81481f790a9f17941bb563938f3

SHA512
2dbea745441b586a953544a51df4e2baf25f24888a451ef5c04f14583aa027682cf19e6f168fbeb8411304296285ed66c779dfc6c259f1cd97eff707eab26763

Download Submit
/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_DynamicOptDex/TLqrS.json

Filesize
598KB

MD5
0ca7c9fccfe9d69bd5c4c2cfe177b2aa

SHA1
0cf9947f391d482ab39f941a39936935574c6e67

SHA256
e38978c06652ab253d53ab57c2691da1e2c96d962edf2fcc1fa5011d1fbe9c41

SHA512
01e708cc4a80e74067ad38b24d1213a3f9b3f83fc0bc7b84555da3f09da11bd3835c65f2f6f008e139f545278ea5a747f95dbcec9a472f3e823704d1874c3063

Download Submit
/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_DynamicOptDex/TLqrS.json

Filesize
598KB

MD5
0b4ed6756ae47ca7b5a5a6b30e53a685

SHA1
e45e1c4c179d9ee92a0df216e55b01a3e07d5385

SHA256
46d12e3881a7458846443f893331cdee478fd3a72ddba85c8a241350d2cf4159

SHA512
d66b53e0c6baa17ec2ac7cf2ea2fd2007be42f251d0c1c6d82a4cbefa8a1ebc8e69264a07bcedc3c3231fe936c5cecece241ad4c9da25c95788850a4c9174d1f

Download Submit
/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_DynamicOptDex/TLqrS.json

Filesize
598KB

MD5
0ca7c9fccfe9d69bd5c4c2cfe177b2aa

SHA1
0cf9947f391d482ab39f941a39936935574c6e67

SHA256
e38978c06652ab253d53ab57c2691da1e2c96d962edf2fcc1fa5011d1fbe9c41

SHA512
01e708cc4a80e74067ad38b24d1213a3f9b3f83fc0bc7b84555da3f09da11bd3835c65f2f6f008e139f545278ea5a747f95dbcec9a472f3e823704d1874c3063

Download Submit
/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
f1bf277c442fde9f6aae2125d79e0088

SHA1
a98552fd9e959d916de729df9a280e1c6734136d

SHA256
eea2a09d75d9500d745f6c67307f13ae65ca2fbc2269f60a06c758e8a4250372

SHA512
f0577166f6294fe72c944f6f67ea557bff0101fcde61ea8bd351ffee3b6a93dc0902d41d669846f996e7579f7e6a0bf790393fdf761dce212c7eac85b064888f

Download Submit
/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_webview/Web Data-journal

Filesize
1KB

MD5
89c34c684fe0e661c03924e68b889062

SHA1
9ce064f75173b70232d92dd6e96836d90f641c61

SHA256
09a29ff5c9e7272fab94512f74e4e1a4effe0e3989109bf4572e8301109717c7

SHA512
7052468c70b55b0b73bb992702eae9535073e31d6e9cf5d43f1f3b94cabeb2534498e8ee4ec067b0ca97b38fbf8274bc6e8ffbb83f44860781b1e6a3cabe7506

Download Submit
/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/app_webview/metrics_guid

Filesize
36B

MD5
3f38ac947095a408023bcf7ddca66058

SHA1
10779f06e8a1c1e57f17401b52e5497f8241c553

SHA256
a88d376dde20143b838e63672c3a76ed0f682bec2e9ac394fdc1113ca5576d5f

SHA512
eda7e368ac5b96749f443677ae83e00ebaa4d5dd5ff9f29f2b61b344ef6ee97962da87b327d36db18844e8d001d849970db4adc283aa4d7f89ac9c39a2a66a15

Download Submit
/data/user/0/zpwhwwuaqknlherqpmotbtze.uxcpzhiyajgogj.bcrzysgxj/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit