alienbot | fd72038524f82d299b58d0b9de0da0cfa10f19eb746ed863fec62345b1044f51

Analysis

max time kernel
870892s
max time network
149s
platform
android_x86
resource
android-x86-arm-20230824-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230824-enlocale:en-usos:android-9-x86system
submitted
26-08-2023 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd72038524f82d299b58d0b9de0da0cfa10f19eb746ed863fec62345b1044f51.apk
Size

1.1MB
MD5

4fe9baeaa3e00d7cc727eec907142ca3
SHA1

5586543fb8cc0d9addb45c3693c88ef10cd0f429
SHA256

fd72038524f82d299b58d0b9de0da0cfa10f19eb746ed863fec62345b1044f51
SHA512

486a1e709deeef21c5cd95fd0f591e2f7f31ae02248fb5f044f9f11504f231458e96da45add14c68c694845d92503554b0c305ec8bfaa6dc445a32b9267e8254
SSDEEP

24576:lzYh349gbHRKAuWJDSemyhwEl08XNTVvzQ4Er:BJ9gbdJue3BXDvzQ4I

Score

10^/10

alienbot cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://girisapi2685.pw

rc4.plain

Extracted

Family

alienbot

http://girisapi2685.pw

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json	family_cerberus
/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json	family_cerberus

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.black.museum

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.black.museum
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.black.museum

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

com.black.museum

pid process

4199 com.black.museum
Acquires the wake lock. 1 IoCs

Processes:

com.black.museum

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.black.museum

pid	process
4199	com.black.museum

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.black.museum

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.black.museum/app_DynamicOptDex/oat/x86/DxAXhSL.odex --compiler-filter=quicken --class-loader-context=&com.black.museum

ioc	pid	process
/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json	4226	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.black.museum/app_DynamicOptDex/oat/x86/DxAXhSL.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json	4199	com.black.museum

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.black.museum

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.black.museum
Removes a system notification. 1 IoCs
evasion

Processes:

com.black.museum

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.black.museum

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.black.museum

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.black.museum

com.black.museum
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4199
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.black.museum/app_DynamicOptDex/oat/x86/DxAXhSL.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4226

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.black.museum/app_DynamicOptDex/DxAXhSL.json

Filesize
238KB

MD5
0de28428e9b631574dc943aea48db66f

SHA1
61d977eabb1cccd708407690eeff260e003448c2

SHA256
d28d4fb61177b629501c44249a16c5c7e52f034883753020488a73acae0c17f9

SHA512
04ab711007a6c2b0fb78cf555f267c6f73643ce055a5703c66381aacfad34dce3a0e3a42cd0e7fd33d657d066b74f2636051d090b6bdede369594db81d27ed45

Download Submit
/data/data/com.black.museum/app_DynamicOptDex/DxAXhSL.json

Filesize
238KB

MD5
d9f21beed701859a2bcfbf79e1c4d05e

SHA1
aebdc87764f12d1412a8845cc8b7e3c04fa72ff4

SHA256
e2c9db53af07fba71804faaa1ae95e73f9c003daa46f39493ec8b949b72f0c1d

SHA512
80c971a811463a17f76faf526a56c609a20165b21946924e9d924e3f633a7c110faa7c250e046001421270ee5572ceb109cec2766a53de449fae7159c4f3f4a8

Download Submit
/data/data/com.black.museum/app_DynamicOptDex/oat/DxAXhSL.json.cur.prof

Filesize
470B

MD5
eaae66741d4211578098a5eb47bb88c0

SHA1
6fa5bc99345924e102d2e981e8e74dc2ec3d5691

SHA256
4a2c73ec07186891bbf3a308bcd29fddc53802f50360b183c3d9bf438471f85b

SHA512
a47429ea3455e6bf8693db5da80ebb67de6abc191b1b6bf7b916ed4613de6b9ebf968ad26bd40ec8dcf78b5cd260d96d1d6e16c57a633e2d4b518633120c5a21

Download Submit
/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json

Filesize
483KB

MD5
65a74842af474c9c32cc576cdf8f1a75

SHA1
d39ee47a34ce6fbae663e04ee1b57a20c68fda34

SHA256
8afe5ff136acb3134418fc08565ffa5cfbd544f411d9720fd4efcc3eb6f1ed80

SHA512
e5d7e18e132bb81d41f97eccace06e4a1ee324513fdf794cc68a86ea2c26bef9b9887fe769d3bafc48c4885256832a5ff5a4bd6e60ecfc49b92452c8e62a54ce

Download Submit
/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json

Filesize
483KB

MD5
90e84dcfce05017ed5eaf3bf0f9f4fdb

SHA1
ce6b608b1971b5d6b9fe9e975186305eb4354bca

SHA256
104aaf9c453b759d677f1ec231f562c7d8aa1b847278a7b8885f0351af6680a2

SHA512
0b900a56b107293370d718d8a1fdd1de9e44c76521a8bce8f59803fe411b97f8d3427dd2b64fcb4364bf79907c45f1acec33294b857fc18ecde34bc8bd109254

Download Submit