alienbot | 6c6958eeef40ab7f3d03f254ad4af9fc76d126d38dc8fde5844c25ba8b03c119

Analysis

max time kernel
876423s
max time network
168s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
05-06-2022 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c6958eeef40ab7f3d03f254ad4af9fc76d126d38dc8fde5844c25ba8b03c119.apk
Size

2.9MB
MD5

051d10f100adda48b8eda53b16db9d3f
SHA1

6f7382d524376e0e382bf98f570e7f491ca4c1b9
SHA256

6c6958eeef40ab7f3d03f254ad4af9fc76d126d38dc8fde5844c25ba8b03c119
SHA512

f7ff693876034db95d4a6f9d183e6745e89e626c525ebfdd0fbbf548e8fc3d68e9c2d92b8fe2b079c3857abb031cd6df290880e08854c071be3c2fda863ad595

Score

10^/10

alienbot banker infostealer trojan

Malware Config

Extracted

Family

alienbot

http://kelime51421.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

museum.surprise.zero

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	museum.surprise.zero
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	museum.surprise.zero

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

museum.surprise.zero

ioc	pid	Process
/data/user/0/museum.surprise.zero/app_DynamicOptDex/ee.json	7068	museum.surprise.zero
/data/user/0/museum.surprise.zero/app_DynamicOptDex/ee.json	7068	museum.surprise.zero

museum.surprise.zero
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:7068
- getprop ro.miui.ui.version.name
  2⤵
  PID:7175
- getprop ro.miui.ui.version.name
  2⤵
  PID:7286
- getprop ro.miui.ui.version.name
  2⤵
  PID:7342
- getprop ro.miui.ui.version.name
  2⤵
  PID:7381
- getprop ro.miui.ui.version.name
  2⤵
  PID:7417
- getprop ro.miui.ui.version.name
  2⤵
  PID:7462
- getprop ro.miui.ui.version.name
  2⤵
  PID:7513

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/museum.surprise.zero/app_DynamicOptDex/ee.json

Filesize
648KB

MD5
32c226800a57f3997963561ba3d8c746

SHA1
354703e630f7944f92c5f5a4a1074a95877b4731

SHA256
486cda4bae16c8cd00396e662bed6e4615c1263821771ab109480c2dddba3d83

SHA512
d819aab912254ff4525ffc306b9f4b6e3dda30942702e47edc396a5bf693da1faa7fa4f7c7ae1383b5054c8c20b1cf27bf859319a815886edd71ea8d4cde1787

Download Submit
/data/user/0/museum.surprise.zero/app_DynamicOptDex/ee.json

Filesize
648KB

MD5
9edcaed0b320b4e1b65ef713e6746f0f

SHA1
4f412f87e5fe6a5413ef6bfc938061ba53ebf4d5

SHA256
6e182d91a10685699206e5f2d15b1a32ac537ea38295f8fb7a1388314702e736

SHA512
8c134d4a83c173973c1f3b56fe249a8e59099ecc9943e67b98f414ec01b9d472afa42097ea7c488c60b35350710c2ca8f0b09798c201f99b3a78eb28f8ed9ab7

Download Submit
/data/user/0/museum.surprise.zero/app_DynamicOptDex/ee.json

Filesize
648KB

MD5
9edcaed0b320b4e1b65ef713e6746f0f

SHA1
4f412f87e5fe6a5413ef6bfc938061ba53ebf4d5

SHA256
6e182d91a10685699206e5f2d15b1a32ac537ea38295f8fb7a1388314702e736

SHA512
8c134d4a83c173973c1f3b56fe249a8e59099ecc9943e67b98f414ec01b9d472afa42097ea7c488c60b35350710c2ca8f0b09798c201f99b3a78eb28f8ed9ab7

Download Submit
/data/user/0/museum.surprise.zero/app_DynamicOptDex/oat/ee.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit