alienbot | cc2f8e85e7045473b9c5ef20ef38357c48493f0695a5144ced49d6b221f47557

Analysis

max time kernel
681418s
max time network
149s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
03/06/2022, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CC2F8E85E7045473B9C5EF20EF38357C48493F0695A5144CED49D6B221F47557.apk
Size

2.1MB
MD5

c9c42e9ef1523105e43c87f05737a503
SHA1

1b64cc4fd0f1c31e72c3c51b81aa65780341bf03
SHA256

cc2f8e85e7045473b9c5ef20ef38357c48493f0695a5144ced49d6b221f47557
SHA512

e8e33b2eaac0dc937ae03bed168cf02c7248b3075358239abe6567aa54110a95442437aa453c95e14f4a579c8c97789ed8fc9e7561a30a48b7c21bb94247f0df

Score

10^/10

alienbot banker evasion infostealer trojan

Malware Config

Extracted

Family

alienbot

http://iphone11acces.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	til.dyuoifkolswkxunrhy.brzo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	til.dyuoifkolswkxunrhy.brzo

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	til.dyuoifkolswkxunrhy.brzo

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_DynamicOptDex/FKNBjoP.json	5072	til.dyuoifkolswkxunrhy.brzo
/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_DynamicOptDex/FKNBjoP.json	5099	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_DynamicOptDex/FKNBjoP.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_DynamicOptDex/oat/x86/FKNBjoP.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_DynamicOptDex/FKNBjoP.json	5072	til.dyuoifkolswkxunrhy.brzo

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	til.dyuoifkolswkxunrhy.brzo

til.dyuoifkolswkxunrhy.brzo
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5072
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_DynamicOptDex/FKNBjoP.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_DynamicOptDex/oat/x86/FKNBjoP.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5099

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_DynamicOptDex/FKNBjoP.json

Filesize
746KB

MD5
787eaecb09dc0adb55f4247999448412

SHA1
2c9af00da826edc7c7f27d1fc05f303f79fb435a

SHA256
2e615d3e75f5f3b54c283c7d36200c31f301d986b397a43f8c16b516636fdbe0

SHA512
aa44ab83f919ffa9c6143fed925efcab79b62782014635e887c9b0257d1704115e40b36c6caa95a8108ac9ca835de46ee812255d388415f71e45b49d5cda7867

Download Submit
/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_DynamicOptDex/FKNBjoP.json

Filesize
746KB

MD5
bee502157b314f8ef002762fe8fc18a8

SHA1
257d8e042014a6b2473bc5b206ff18e4d6ef579b

SHA256
72f97ddba9280f294767d26b5b81802731a58d86c087b61ad0667953c7690473

SHA512
0391293ef1a2c1306390b05438c791c977e4f5e1b9df2030e845e8f68ec0acd5635c4986ae60d28854ed290685156e9fc37903d81f5b2c04af25fb7bdaf789b9

Download Submit
/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_DynamicOptDex/FKNBjoP.json

Filesize
746KB

MD5
e6546220fc93a3b7829aceea636af8b5

SHA1
3576529693df2086ee39146baf6f782939224b2b

SHA256
dcaaa83c019d1227c952b67436ab388269cd7925f6a2ceb101ee69c962e35662

SHA512
09d2b33f2b0e300f60357aaa2274ddbe7179240d082b585d1ad83b50cabaa574de7bcd6434b4ae80487f342b73aa289d4fc5c128ef383b04c2a5471d1248c0fb

Download Submit
/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_DynamicOptDex/FKNBjoP.json

Filesize
746KB

MD5
bee502157b314f8ef002762fe8fc18a8

SHA1
257d8e042014a6b2473bc5b206ff18e4d6ef579b

SHA256
72f97ddba9280f294767d26b5b81802731a58d86c087b61ad0667953c7690473

SHA512
0391293ef1a2c1306390b05438c791c977e4f5e1b9df2030e845e8f68ec0acd5635c4986ae60d28854ed290685156e9fc37903d81f5b2c04af25fb7bdaf789b9

Download Submit
/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
f075ac5113b67a6b67c6e93966355a84

SHA1
7b9e0710ac143c8281796ef6050ce77c9860632b

SHA256
436ffbdf67cc864446b7966628f4b26f6791dceb30b5a47ce849a2860f0bae4e

SHA512
20f9024afe8e7d80e077a26c95a67ef92c4e4a8fe797e2dbe85b43a1128d9143c734aa554b8241cf17f768899eeb17b9ccace1b6855cbb62f29f68b71a36b5e6

Download Submit
/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_webview/Web Data-journal

Filesize
1KB

MD5
37cf5cc2565eef1cbe8560057e8e233d

SHA1
03a25f70f7bffcb38a532f9383c8d50f6bff6391

SHA256
6c0d2f7a30fa83ae9bd1a0df33e008006834cf1eaa65e48b9433ed314690ad32

SHA512
1cffb84e9d6174e5f40d4686e9e76e6f828573deb8b7c5e33206698fc58f890b660ff6d8f2a069e664f0656b143ceb395ad7e01a9f8f727f4af8097fe4d33818

Download Submit
/data/user/0/til.dyuoifkolswkxunrhy.brzo/app_webview/metrics_guid

Filesize
36B

MD5
fc4db51c1a5a7ee3a7565a68c453ac8e

SHA1
cb52fb3d97f8768449b73a37e9167b770a72190f

SHA256
c40df345cb681b69db9a26dd1e7b03a29b28e33e843354acf97b2580fb7b09cf

SHA512
4c3739de1bcdf3cdd3fb0c9d069a8a10b9be8f66eea14f8939c82afc75205c4c2ec68d4be10ec76217a447800f6907168fca45cb7490c39218c5058b143509ae

Download Submit
/data/user/0/til.dyuoifkolswkxunrhy.brzo/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit