alienbot | baef3c30e6790572cd2b8f85325279d28aa9c5547ae62ed2d14215fa985a8ded

Analysis

max time kernel
1902215s
max time network
165s
platform
android_x64
resource
android-x64-arm64-20230831-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system
submitted
07-09-2023 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

baef3c30e6790572cd2b8f85325279d28aa9c5547ae62ed2d14215fa985a8ded.apk
Size

2.8MB
MD5

3de95c460ac3a94c42d8b24837ba90c3
SHA1

31fa866184468d24760a25db57fec72ca71a9618
SHA256

baef3c30e6790572cd2b8f85325279d28aa9c5547ae62ed2d14215fa985a8ded
SHA512

41381d60c9cfbdda55eee351cb2b5d835f27964fee53893fdc77b7e80b3616dc171efe2d2fa86dddd9789bc37bd4d937c394c4d09bfa08e2d5fa208e3367c7b7
SSDEEP

49152:CfBFCzfQ5Jo2+8KZmsuvgFR5/FFTF+0wupmPH3Fg7ku0HP4JV0MulHQEutc7Y:s00zKZmLvgbhZouY3a7k7vQuMu9QEutv

Score

10^/10

alienbot cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://uniquebbs.asia

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 3 IoCs

Processes:

resource	yara_rule
/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json	family_cerberus
/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json	family_cerberus
/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json	family_cerberus

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

slow.energy.impose

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	slow.energy.impose
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	slow.energy.impose

Removes its main activity from the application launcher 5 IoCs
stealth trojan

Processes:

slow.energy.impose

pid process

4556 slow.energy.impose
4556 slow.energy.impose
4556 slow.energy.impose
4556 slow.energy.impose
4556 slow.energy.impose

pid	process
4556	slow.energy.impose
4556	slow.energy.impose
4556	slow.energy.impose
4556	slow.energy.impose
4556	slow.energy.impose

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

slow.energy.impose

ioc	pid	process
/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json	4556	slow.energy.impose
/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json	4556	slow.energy.impose

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

slow.energy.impose

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS slow.energy.impose

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	slow.energy.impose

slow.energy.impose
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4556
- getprop ro.miui.ui.version.name
  2⤵
  PID:4669
- getprop ro.miui.ui.version.name
  2⤵
  PID:4793
- getprop ro.miui.ui.version.name
  2⤵
  PID:4921
- getprop ro.miui.ui.version.name
  2⤵
  PID:4960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json

Filesize
640KB

MD5
000d090ab5b6cfffd7b421faeade73ba

SHA1
c26546d6326c907390f3143513e302b6bfd91a38

SHA256
928303543157a10a22f331328bc762c25a86f20b3b798cb75b04da5bc275347d

SHA512
0218849392fff7cd018cee5249998951628340376b9da598ac859dc825d49067afbbb2a00691cac47d7b140515cac65d27aa176dcce912dbda3de28a5271b672

Download Submit
/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json

Filesize
640KB

MD5
e9f35065ec679555c38c8f35d3a3ab21

SHA1
7a100651d596e25b9254d56b16da7bd094cbf7ba

SHA256
ebfb1a0df4ec7a347a6a4074cfcb2c9fd13ba4de7bbe1bc87dc8d1b2ab2f2199

SHA512
2736532eb3a10a382ce920ad0bdf8539d427cc3160732ed5e8ae05d1908a968c6ae9c633a1f458b993d05afd8f9c8e76c6c3ccea5b86b97cc7a45c957d0bec2f

Download Submit
/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json

Filesize
640KB

MD5
e9f35065ec679555c38c8f35d3a3ab21

SHA1
7a100651d596e25b9254d56b16da7bd094cbf7ba

SHA256
ebfb1a0df4ec7a347a6a4074cfcb2c9fd13ba4de7bbe1bc87dc8d1b2ab2f2199

SHA512
2736532eb3a10a382ce920ad0bdf8539d427cc3160732ed5e8ae05d1908a968c6ae9c633a1f458b993d05afd8f9c8e76c6c3ccea5b86b97cc7a45c957d0bec2f

Download Submit
/data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json

Filesize
640KB

MD5
e9f35065ec679555c38c8f35d3a3ab21

SHA1
7a100651d596e25b9254d56b16da7bd094cbf7ba

SHA256
ebfb1a0df4ec7a347a6a4074cfcb2c9fd13ba4de7bbe1bc87dc8d1b2ab2f2199

SHA512
2736532eb3a10a382ce920ad0bdf8539d427cc3160732ed5e8ae05d1908a968c6ae9c633a1f458b993d05afd8f9c8e76c6c3ccea5b86b97cc7a45c957d0bec2f

Download Submit
/data/user/0/slow.energy.impose/app_DynamicOptDex/oat/AENm.json.cur.prof

Filesize
329B

MD5
8c8fa24bf11acdb1db4ff8d9df58e7cb

SHA1
d075ae5ca3f90c426702f5412d7ce3b2bbd84a54

SHA256
a1ff4846a84fc5cdd1450f70b8321361b704e6f89cc8a4ab91cf9bc243b302c8

SHA512
d4637bf19cff71b647e6a28866a9c3ac612d3dcd7ec42f0e924c98fa1f1d2161b4fb42f83730c0ded26b6c84817b6126627fe06d7fb29e09796e2410b9d6f10c

Download Submit