alienbot | 023401cb52793c28925cd213f4c8ef48cef18b904cfcee01880cb219f8844cfc

General

Target

023401cb52793c28925cd213f4c8ef48cef18b904cfcee01880cb219f8844cfc.apk
Size

2.1MB
MD5

f962f5880d51312dc97276cd17f35f63
SHA1

e432cd2258dec9fd05470726e9648a7501839b3f
SHA256

023401cb52793c28925cd213f4c8ef48cef18b904cfcee01880cb219f8844cfc
SHA512

d146f9b8be9cad7e13730b4f70b7ed144b2bef7c783cd8728d73c5dfc7b09b64a3176f3e69bc4a3b6bad4aea558026d62f3deba6b6d88ab7192d22869020ef43
SSDEEP

49152:Bn1jZ+H/ztKOsWzWg2aMy0J0801I/rfhLxxOaQRmDcl1dIpkJnR/59G:51kfztjsvN/hLPNQRiML9G

Score

10^/10

alienbot cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

C2

http://dijitalgirisbigi.net

rc4.plain

Extracted

Family

alienbot

C2

http://dijitalgirisbigi.net

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 2 IoCs

resource	yara_rule
behavioral1/memory/4195-0.dex	family_cerberus
behavioral1/memory/4164-0.dex	family_cerberus

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.update.layer
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.update.layer

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.update.layer

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4164	com.update.layer

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.update.layer

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.update.layer/app_DynamicOptDex/OPr.json	4195	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.update.layer/app_DynamicOptDex/OPr.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.update.layer/app_DynamicOptDex/oat/x86/OPr.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.update.layer/app_DynamicOptDex/OPr.json	4164	com.update.layer

Reads the content of SMS inbox messages. 1 IoCs

infostealer

description	ioc	Process
URI accessed for read	content://sms/inbox	com.update.layer

Reads the content of outgoing SMS messages. 2 IoCs

infostealer

description	ioc	Process
URI accessed for read	content://sms/sent	com.update.layer
URI accessed for read	content://sms/draft	com.update.layer

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.update.layer

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.update.layer

com.update.layer
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Reads the content of outgoing SMS messages.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4164
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.update.layer/app_DynamicOptDex/OPr.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.update.layer/app_DynamicOptDex/oat/x86/OPr.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4195

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.update.layer/app_DynamicOptDex/OPr.json

Filesize
238KB

MD5
68f3cd8b1a755b7d95db5d365f17be41

SHA1
e7fe149662d7abf0db23867bfb37614d13a5e46b

SHA256
df2ceee8c9d4d2c6a647124edd34be049d7d96c9214c804b5f199000e392ab4c

SHA512
644d3d6baf4e0a5bb83f353adbbf2d7ee642ccc6abad628d6e97ff5958b6e31991dbabf7d2521852d3d7a808945c0e3cdb17e368a16b190a3abbc4ef1e8de4f2

Download Submit
/data/data/com.update.layer/app_DynamicOptDex/OPr.json

Filesize
238KB

MD5
c109dd6eff0c0f53a5e5daccda39c6bd

SHA1
47808bf2b9fd7ddfeb3fc14ed1626ad98dc0c609

SHA256
2d5d2920efe76ba1ea12691ab8f02a7fba4bbeecf9d73df5592191de7d428d99

SHA512
f551c97248cc87804b733ea341b8bc86a4a146a347233a2d2efdd4901a70d45e6f7589acf14005c804f38107b52d8d11368ddcacf1d8155b4aab1cce677703e0

Download Submit
/data/data/com.update.layer/app_DynamicOptDex/oat/OPr.json.cur.prof

Filesize
489B

MD5
c7c5c33a790bbc690696daa46230826b

SHA1
256557bc055a06b5cc071786991369008f6de2a2

SHA256
18e913476057a5384a0cf6d1154d197d9758ad1274ec5631e1bdd46a6c1c9269

SHA512
7219be22e6355c93f50e6a6d35739c6dd713d075a1e4570035fbdf5cbb5c147025d7f2424e399273d53810607053082e6f49a9a1b5ee54dfc32e237bf6cd9a37

Download Submit
/data/data/com.update.layer/app_DynamicOptDex/oat/OPr.json.cur.prof

Filesize
566B

MD5
fafdd7bbc3be601eca37891e1c6511d2

SHA1
76e193f68dfa41895c386ab66a6da255dcf96fc2

SHA256
12f92e69ea51392207ec29c4e5ee1837e115c823d34babe59d4604c992aee025

SHA512
f46b14ff0426de1a176a234083efb96cded5fca312202dd74006f726b0af2c9a3fa11f3d12283d3afb484f17b95b9056d613a8a783c16523a1976f3a3422dfc1

Download Submit
/data/data/com.update.layer/app_apk/ring0.apk

Filesize
946KB

MD5
a73f108dc1b655252c7e45e5df04d4f6

SHA1
8459f380f7ef684e393c4408f7f4ee58c99147c4

SHA256
c34367f5395f513b8ee0dedcd5502aed69172e71004a80c1f896ca97e05f4f62

SHA512
8f84e47b367fb35a073a31cf41422edccbde99ee126cb37d2df0bddae5e8ca0f5df4d6221930548bfd216f583b2885485d764fd58f73d6a14b9a697b66c58dc4

Download Submit
/data/user/0/com.update.layer/app_DynamicOptDex/OPr.json

Filesize
483KB

MD5
b2937c219f63af4d51fc860cb4a82a85

SHA1
7c78c6c344fbfe45a34b85aee96cdd40581e3485

SHA256
bfbc4bc27b9e1b9747537f013c3781f66721086bfe24c9e3c5c817f469b5b710

SHA512
a1c8700fca781b17b603f5f5634564b6848c17ab7c2304f14ddf9fd666e6d884f0288003e7a923062549a5b6d7f3114593e5ade0221325584f9e329f7d3b1399

Download Submit
/data/user/0/com.update.layer/app_DynamicOptDex/OPr.json

Filesize
483KB

MD5
0cb0220dd8a1afab6c9d6edb350400b7

SHA1
3b82338663a83909b251293472b1c5b5dbdb3a67

SHA256
bac9a8616d99c9befb0594b99ab7b9c47074f2a4047f7c998b66fd00f38d0504

SHA512
78822ad33a457e5128181a411e6bb0ad9a9357d130205e58a1c39a122f3fa3aef9a91d0df446cc089bc70c2ad126797758bc19f910050c247a5b7265e63f0864

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads