alienbot | baef3c30e6790572cd2b8f85325279d28aa9c5547ae62ed2d14215fa985a8ded

Analysis

max time kernel
1902220s
max time network
139s
platform
android_x86
resource
android-x86-arm-20230831-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
submitted
07-09-2023 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

baef3c30e6790572cd2b8f85325279d28aa9c5547ae62ed2d14215fa985a8ded.apk
Size

2.8MB
MD5

3de95c460ac3a94c42d8b24837ba90c3
SHA1

31fa866184468d24760a25db57fec72ca71a9618
SHA256

baef3c30e6790572cd2b8f85325279d28aa9c5547ae62ed2d14215fa985a8ded
SHA512

41381d60c9cfbdda55eee351cb2b5d835f27964fee53893fdc77b7e80b3616dc171efe2d2fa86dddd9789bc37bd4d937c394c4d09bfa08e2d5fa208e3367c7b7
SSDEEP

49152:CfBFCzfQ5Jo2+8KZmsuvgFR5/FFTF+0wupmPH3Fg7ku0HP4JV0MulHQEutc7Y:s00zKZmLvgbhZouY3a7k7vQuMu9QEutv

Score

10^/10

alienbot cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://uniquebbs.asia

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/files/fstream-2.dat	family_cerberus
behavioral1/memory/4179-0.dex	family_cerberus
behavioral1/memory/4205-0.dex	family_cerberus
behavioral1/memory/4179-1.dex	family_cerberus

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

slow.energy.impose

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	slow.energy.impose
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	slow.energy.impose

Removes its main activity from the application launcher 1 IoCs

stealth trojan

Processes:

slow.energy.impose

pid	Process
4179	slow.energy.impose

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

slow.energy.impose/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/slow.energy.impose/app_DynamicOptDex/oat/x86/AENm.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json	4179	slow.energy.impose
/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json	4205	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/slow.energy.impose/app_DynamicOptDex/oat/x86/AENm.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json	4179	slow.energy.impose

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

Processes:

slow.energy.impose

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	slow.energy.impose

Removes a system notification. 1 IoCs

evasion

Processes:

slow.energy.impose

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	slow.energy.impose

slow.energy.impose
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4179
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/slow.energy.impose/app_DynamicOptDex/oat/x86/AENm.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4205

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/slow.energy.impose/app_DynamicOptDex/AENm.json

Filesize
640KB

MD5
000d090ab5b6cfffd7b421faeade73ba

SHA1
c26546d6326c907390f3143513e302b6bfd91a38

SHA256
928303543157a10a22f331328bc762c25a86f20b3b798cb75b04da5bc275347d

SHA512
0218849392fff7cd018cee5249998951628340376b9da598ac859dc825d49067afbbb2a00691cac47d7b140515cac65d27aa176dcce912dbda3de28a5271b672

Download Submit
/data/data/slow.energy.impose/app_DynamicOptDex/AENm.json

Filesize
640KB

MD5
e9f35065ec679555c38c8f35d3a3ab21

SHA1
7a100651d596e25b9254d56b16da7bd094cbf7ba

SHA256
ebfb1a0df4ec7a347a6a4074cfcb2c9fd13ba4de7bbe1bc87dc8d1b2ab2f2199

SHA512
2736532eb3a10a382ce920ad0bdf8539d427cc3160732ed5e8ae05d1908a968c6ae9c633a1f458b993d05afd8f9c8e76c6c3ccea5b86b97cc7a45c957d0bec2f

Download Submit
/data/data/slow.energy.impose/app_DynamicOptDex/oat/AENm.json.cur.prof

Filesize
409B

MD5
afb06392f1d752e1efc3446e99029786

SHA1
e2c532ca3db3e0801abe38e5f8d759a8bd6ab6d5

SHA256
c5599605955b9104633909d2afee2c76964cb7aa5c96928005c07a92516adeef

SHA512
23e790f07f6947c430df57082993047808b85c687556bb0b1b23309a21ffccc8406d73a72d68d609c63d1e6d06874e0e953583fb80b9fd36a90fe6176e42dd6b

Download Submit
/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json

Filesize
640KB

MD5
e9f35065ec679555c38c8f35d3a3ab21

SHA1
7a100651d596e25b9254d56b16da7bd094cbf7ba

SHA256
ebfb1a0df4ec7a347a6a4074cfcb2c9fd13ba4de7bbe1bc87dc8d1b2ab2f2199

SHA512
2736532eb3a10a382ce920ad0bdf8539d427cc3160732ed5e8ae05d1908a968c6ae9c633a1f458b993d05afd8f9c8e76c6c3ccea5b86b97cc7a45c957d0bec2f

Download Submit
/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json

Filesize
640KB

MD5
cad5d17228d925e843a4be025b1c60e7

SHA1
dbf56501665f0b2bbf7cacb31dd23060c63ba425

SHA256
449cbafd67d92fe35461db32e2c75333afb5985aac8d88d6feb6c8c85feb028c

SHA512
787d97be050250ff029f5ac297a8c1f84939a6d5bf2e82431a0a575bae0044a9fd437bd15c25f152320e9cd3c560a5b0186513caf46cb457c54c5f2fcdd2815b

Download Submit
/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json

Filesize
640KB

MD5
e9f35065ec679555c38c8f35d3a3ab21

SHA1
7a100651d596e25b9254d56b16da7bd094cbf7ba

SHA256
ebfb1a0df4ec7a347a6a4074cfcb2c9fd13ba4de7bbe1bc87dc8d1b2ab2f2199

SHA512
2736532eb3a10a382ce920ad0bdf8539d427cc3160732ed5e8ae05d1908a968c6ae9c633a1f458b993d05afd8f9c8e76c6c3ccea5b86b97cc7a45c957d0bec2f

Download Submit