alienbot | fd72038524f82d299b58d0b9de0da0cfa10f19eb746ed863fec62345b1044f51

Analysis

max time kernel
870857s
max time network
169s
platform
android_x64
resource
android-x64-arm64-20230824-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230824-enlocale:en-usos:android-11-x64system
submitted
26-08-2023 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd72038524f82d299b58d0b9de0da0cfa10f19eb746ed863fec62345b1044f51.apk
Size

1.1MB
MD5

4fe9baeaa3e00d7cc727eec907142ca3
SHA1

5586543fb8cc0d9addb45c3693c88ef10cd0f429
SHA256

fd72038524f82d299b58d0b9de0da0cfa10f19eb746ed863fec62345b1044f51
SHA512

486a1e709deeef21c5cd95fd0f591e2f7f31ae02248fb5f044f9f11504f231458e96da45add14c68c694845d92503554b0c305ec8bfaa6dc445a32b9267e8254
SSDEEP

24576:lzYh349gbHRKAuWJDSemyhwEl08XNTVvzQ4Er:BJ9gbdJue3BXDvzQ4I

Score

10^/10

alienbot cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://girisapi2685.pw

rc4.plain

Extracted

Family

alienbot

http://girisapi2685.pw

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json	family_cerberus

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.black.museum

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.black.museum
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.black.museum

Removes its main activity from the application launcher 8 IoCs

stealth trojan

Processes:

com.black.museum

pid	process
4407	com.black.museum
4407	com.black.museum
4407	com.black.museum
4407	com.black.museum
4407	com.black.museum
4407	com.black.museum
4407	com.black.museum
4407	com.black.museum

Acquires the wake lock. 1 IoCs

Processes:

com.black.museum

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.black.museum
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.black.museum

ioc pid process

/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json 4407 com.black.museum
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.black.museum

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.black.museum

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.black.museum

ioc	pid	process
/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json	4407	com.black.museum

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.black.museum

com.black.museum
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4407
- getprop ro.miui.ui.version.name
  2⤵
  PID:4562
- getprop ro.miui.ui.version.name
  2⤵
  PID:4666
- getprop ro.miui.ui.version.name
  2⤵
  PID:4828
- getprop ro.miui.ui.version.name
  2⤵
  PID:4861
- getprop ro.miui.ui.version.name
  2⤵
  PID:4888
- getprop ro.miui.ui.version.name
  2⤵
  PID:4922
- getprop ro.miui.ui.version.name
  2⤵
  PID:4957

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json

Filesize
238KB

MD5
0de28428e9b631574dc943aea48db66f

SHA1
61d977eabb1cccd708407690eeff260e003448c2

SHA256
d28d4fb61177b629501c44249a16c5c7e52f034883753020488a73acae0c17f9

SHA512
04ab711007a6c2b0fb78cf555f267c6f73643ce055a5703c66381aacfad34dce3a0e3a42cd0e7fd33d657d066b74f2636051d090b6bdede369594db81d27ed45

Download Submit
/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json

Filesize
238KB

MD5
d9f21beed701859a2bcfbf79e1c4d05e

SHA1
aebdc87764f12d1412a8845cc8b7e3c04fa72ff4

SHA256
e2c9db53af07fba71804faaa1ae95e73f9c003daa46f39493ec8b949b72f0c1d

SHA512
80c971a811463a17f76faf526a56c609a20165b21946924e9d924e3f633a7c110faa7c250e046001421270ee5572ceb109cec2766a53de449fae7159c4f3f4a8

Download Submit
/data/user/0/com.black.museum/app_DynamicOptDex/DxAXhSL.json

Filesize
483KB

MD5
90e84dcfce05017ed5eaf3bf0f9f4fdb

SHA1
ce6b608b1971b5d6b9fe9e975186305eb4354bca

SHA256
104aaf9c453b759d677f1ec231f562c7d8aa1b847278a7b8885f0351af6680a2

SHA512
0b900a56b107293370d718d8a1fdd1de9e44c76521a8bce8f59803fe411b97f8d3427dd2b64fcb4364bf79907c45f1acec33294b857fc18ecde34bc8bd109254

Download Submit
/data/user/0/com.black.museum/app_DynamicOptDex/oat/DxAXhSL.json.cur.prof

Filesize
319B

MD5
a20b60935c8f345d83d197d3d5e4d1a5

SHA1
5b55cee7b2a6ddd4ecef4d15d055380b4f011527

SHA256
4669a4f1ebd6cfd4e4e56f94c577744c3f673e8bc4374e064af43a8cbda5b913

SHA512
cf3bbb5cc191ce90fc9ed4473bc0334ae4e779fbe514750c60ee7fbf3d0887d1e8fcd8e11cd2c0e676234c71044e14ff0ad47f9e6156b9086b4d9dd96872cdcc

Download Submit