alienbot | 0422433a6cea4da9fa32db2410144f406f01eec5ff5915b2b8c192ec3639b363

Analysis

max time kernel
2343441s
max time network
151s
platform
android_x64
resource
android-x64-arm64-20230831-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system
submitted
12-09-2023 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0422433a6cea4da9fa32db2410144f406f01eec5ff5915b2b8c192ec3639b363.apk
Size

2.1MB
MD5

e40024f930c3f19b89b0f0639e3e048c
SHA1

44255903ab77c97c9de06e7a52921593cdb89483
SHA256

0422433a6cea4da9fa32db2410144f406f01eec5ff5915b2b8c192ec3639b363
SHA512

326d8facbbd82b6eeac70a04ab5cbc3426a5e5242d4edf3dd49109e75742838cd0edb7e4018ca82321cc72f086fcff33d106805628d5f370df97fea5b70b0fcc
SSDEEP

49152:L6pmUQoDTrOiCFPA2gL0J0801VBUf2cRqcl1dIpkJ8Rp5/0xNew:1ULrOiCFAM2cyMy/0PR

Score

10^/10

alienbot cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://limit-tanimlama.net

rc4.plain

Extracted

Family

alienbot

http://limit-tanimlama.net

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.supply.oil/app_DynamicOptDex/GybLWWK.json	family_cerberus

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.supply.oil

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.supply.oil
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.supply.oil

Removes its main activity from the application launcher 8 IoCs

stealth trojan

Processes:

com.supply.oil

pid	process
4599	com.supply.oil
4599	com.supply.oil
4599	com.supply.oil
4599	com.supply.oil
4599	com.supply.oil
4599	com.supply.oil
4599	com.supply.oil
4599	com.supply.oil

Acquires the wake lock. 1 IoCs

Processes:

com.supply.oil

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.supply.oil
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.supply.oil

ioc pid process

/data/user/0/com.supply.oil/app_DynamicOptDex/GybLWWK.json 4599 com.supply.oil
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.supply.oil

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.supply.oil

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.supply.oil

ioc	pid	process
/data/user/0/com.supply.oil/app_DynamicOptDex/GybLWWK.json	4599	com.supply.oil

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.supply.oil

com.supply.oil
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4599
- getprop ro.miui.ui.version.name
  2⤵
  PID:4773
- getprop ro.miui.ui.version.name
  2⤵
  PID:4867
- getprop ro.miui.ui.version.name
  2⤵
  PID:5008
- getprop ro.miui.ui.version.name
  2⤵
  PID:5041
- getprop ro.miui.ui.version.name
  2⤵
  PID:5071
- getprop ro.miui.ui.version.name
  2⤵
  PID:5102
- getprop ro.miui.ui.version.name
  2⤵
  PID:5135

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.supply.oil/app_DynamicOptDex/GybLWWK.json

Filesize
238KB

MD5
10a6e436b0bee31a9f2ed74b4d6a50b7

SHA1
0360f72ad2b82c42da703114162d8b4566613481

SHA256
087fd075a58880efd16d03724740416bf331634a3bffce2af075172f709837fe

SHA512
6b62579a92291baf3844eb4747eb2a05024f4283bb35906aa415b265b3f008a87a159c89890b1f7ba4789d87125c1e92c6fde75408209a3d1872f9b1b8c014e5

Download Submit
/data/user/0/com.supply.oil/app_DynamicOptDex/GybLWWK.json

Filesize
238KB

MD5
784200c45e8d5ec0e504d4e09cb8fc87

SHA1
d4c2d36a6e328a28108cf4cdd3bae967f65369b3

SHA256
05514060c89e27fae692115142f190dc10e39060d21a0e9523da6cf684d5a84f

SHA512
476cbaa17406636f20cf23062c69902d57f0199a053e556cb15ad6f0c3b5722ab9b5ddf81b38b9cc2754c162b8050cd20a6250793af60507600c23dc35050a0c

Download Submit
/data/user/0/com.supply.oil/app_DynamicOptDex/GybLWWK.json

Filesize
483KB

MD5
013a804a457ce0c5e63f4003bd15c301

SHA1
1dd06b6d8465833e012c9cc070d63844b176ef6a

SHA256
5ee7fd2974b8ba94491cd02575da34d60affe0228ae5a30ad478d820e0226663

SHA512
a121e0a32bf0eebf9239b8e52d6efb1df4655c0c11314bf08620897431c1d297019caf4122acb73ced329552460770afcc4464d13199b928290b6180a3963fcb

Download Submit
/data/user/0/com.supply.oil/app_DynamicOptDex/oat/GybLWWK.json.cur.prof

Filesize
324B

MD5
fe72a0bee3f91d07c1e523e4b096b5bd

SHA1
21045ce0eb459c7181c291cd6210e11238aa0957

SHA256
2edb1211b27277a361c69da6e2987b0bd109598d903b7578da70d1a63b38beb3

SHA512
29c5e4879bc99dd486b88aa2de8108b0fd30e71b7c52b3808e75dab983be52a06a6f8da84cf8eca6baab40308543ea5d6a1f535f4eb9d14dddd5fb71add732b2

Download Submit