alienbot | fd72038524f82d299b58d0b9de0da0cfa10f19eb746ed863fec62345b1044f51

Analysis

max time kernel
870921s
max time network
167s
platform
android_x64
resource
android-x64-20230824-en
resource tags

androidarch:x64arch:x86image:android-x64-20230824-enlocale:en-usos:android-10-x64system
submitted
26-08-2023 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd72038524f82d299b58d0b9de0da0cfa10f19eb746ed863fec62345b1044f51.apk
Size

1.1MB
MD5

4fe9baeaa3e00d7cc727eec907142ca3
SHA1

5586543fb8cc0d9addb45c3693c88ef10cd0f429
SHA256

fd72038524f82d299b58d0b9de0da0cfa10f19eb746ed863fec62345b1044f51
SHA512

486a1e709deeef21c5cd95fd0f591e2f7f31ae02248fb5f044f9f11504f231458e96da45add14c68c694845d92503554b0c305ec8bfaa6dc445a32b9267e8254
SSDEEP

24576:lzYh349gbHRKAuWJDSemyhwEl08XNTVvzQ4Er:BJ9gbdJue3BXDvzQ4I

Score

10^/10

alienbot cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://girisapi2685.pw

rc4.plain

Extracted

Family

alienbot

http://girisapi2685.pw

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json	family_cerberus

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.black.museum

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.black.museum
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.black.museum

Removes its main activity from the application launcher 3 IoCs
stealth trojan

Processes:

com.black.museum

pid process

4993 com.black.museum
4993 com.black.museum
4993 com.black.museum
Acquires the wake lock. 1 IoCs

Processes:

com.black.museum

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.black.museum
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.black.museum

ioc pid process

/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json 4993 com.black.museum

pid	process
4993	com.black.museum
4993	com.black.museum
4993	com.black.museum

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.black.museum

ioc	pid	process
/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json	4993	com.black.museum

com.black.museum
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:4993
- getprop ro.miui.ui.version.name
  2⤵
  PID:5139
- getprop ro.miui.ui.version.name
  2⤵
  PID:5239

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.black.museum/app_DynamicOptDex/DxAXhSL.json

Filesize
238KB

MD5
0de28428e9b631574dc943aea48db66f

SHA1
61d977eabb1cccd708407690eeff260e003448c2

SHA256
d28d4fb61177b629501c44249a16c5c7e52f034883753020488a73acae0c17f9

SHA512
04ab711007a6c2b0fb78cf555f267c6f73643ce055a5703c66381aacfad34dce3a0e3a42cd0e7fd33d657d066b74f2636051d090b6bdede369594db81d27ed45

Download Submit
/data/data/com.black.museum/app_DynamicOptDex/DxAXhSL.json

Filesize
238KB

MD5
d9f21beed701859a2bcfbf79e1c4d05e

SHA1
aebdc87764f12d1412a8845cc8b7e3c04fa72ff4

SHA256
e2c9db53af07fba71804faaa1ae95e73f9c003daa46f39493ec8b949b72f0c1d

SHA512
80c971a811463a17f76faf526a56c609a20165b21946924e9d924e3f633a7c110faa7c250e046001421270ee5572ceb109cec2766a53de449fae7159c4f3f4a8

Download Submit
/data/data/com.black.museum/app_DynamicOptDex/oat/DxAXhSL.json.cur.prof

Filesize
380B

MD5
c4fbb00868822e8cedc9c1c03b9c505e

SHA1
bd16ca3937dee6c182f9dfca5a6fff3f8e541163

SHA256
961b037336d51b68882a1adcd0c88eddba5c64eec97084354d8be56280200cc7

SHA512
709595b2540b44aa697be89621fe32888d5bc20eed1dcade6c452a817cf6eff9dfffe78d7cdb838cc3b2d9fca33a4e73852892825515330a02d17a0f0622fa82

Download Submit
/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json

Filesize
483KB

MD5
90e84dcfce05017ed5eaf3bf0f9f4fdb

SHA1
ce6b608b1971b5d6b9fe9e975186305eb4354bca

SHA256
104aaf9c453b759d677f1ec231f562c7d8aa1b847278a7b8885f0351af6680a2

SHA512
0b900a56b107293370d718d8a1fdd1de9e44c76521a8bce8f59803fe411b97f8d3427dd2b64fcb4364bf79907c45f1acec33294b857fc18ecde34bc8bd109254

Download Submit