alienbot | 28cf23f76582b13705346e8fe77802785267e6b2ab2072bf9c2b9b918b2b588b

Analysis

max time kernel
3355946s
max time network
166s
platform
android_x64
resource
android-x64-20231023.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20231023.1-enlocale:en-usos:android-10-x64system
submitted
13-11-2023 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

2.2MB
MD5

f962034252259d770995b760cf804ed4
SHA1

92a4967469877bb134e81bdaec0a8a1171c79dc6
SHA256

28cf23f76582b13705346e8fe77802785267e6b2ab2072bf9c2b9b918b2b588b
SHA512

7a96a65c09cf73689c041b8a4de219c6fef2a1b824efa925baf9b6afe2a8ed314c044d631d6106d30df69b5b1c593949516668650c25fbc80921f1afeeb33c7c
SSDEEP

49152:K7wyceKi6ssGECKmviJRpLof9/n39pdRxOKTH1luTdMS:5ZLmE9AQnLUF3HMKTHSdX

Score

10^/10

alienbot cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://comolokko4152ertausicken.gq/

rc4.plain

Extracted

Family

alienbot

http://comolokko4152ertausicken.gq/

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.timber.funny/app_DynamicOptDex/oQXZESo.json	family_cerberus

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.timber.funny

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.timber.funny
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.timber.funny

Removes its main activity from the application launcher 3 IoCs
stealth trojan

Processes:

com.timber.funny

pid process

4922 com.timber.funny
4922 com.timber.funny
4922 com.timber.funny
Acquires the wake lock. 1 IoCs

Processes:

com.timber.funny

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.timber.funny
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.timber.funny

ioc pid process

/data/user/0/com.timber.funny/app_DynamicOptDex/oQXZESo.json 4922 com.timber.funny

pid	process
4922	com.timber.funny
4922	com.timber.funny
4922	com.timber.funny

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.timber.funny

ioc	pid	process
/data/user/0/com.timber.funny/app_DynamicOptDex/oQXZESo.json	4922	com.timber.funny

com.timber.funny
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:4922
- getprop ro.miui.ui.version.name
  2⤵
  PID:5168
- getprop ro.miui.ui.version.name
  2⤵
  PID:5246

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.timber.funny/app_DynamicOptDex/oQXZESo.json

Filesize
238KB

MD5
b9ef71e496c13f1d0adb890f09b0a6ac

SHA1
a0b768653d33a43094ec5d325fd14169f8e2943f

SHA256
2681dd696c408d25daecaa524b7ea7a8491e94cdc8c7e41f96de5650bba91e80

SHA512
189eb39f1b89a0768e5ad524289688a8bcddb7be1d84cdb9cf7eae9ea01a40a69207bbbd14d71a5bed0c38726726cc7ff4fb3ebe0e751817ac21f8bdce4c072e

Download Submit
/data/data/com.timber.funny/app_DynamicOptDex/oQXZESo.json

Filesize
238KB

MD5
27fba65ca18b132e52e55df1dc2d710a

SHA1
45e418b090bbaa73751145cd003ec18d91d68a10

SHA256
72147d67aefb8b20893ff3f22f75d449a29b56d67d0a4fdda255187f6a5885a7

SHA512
1f50c7bc719dbccb6ef74a5a56c02681e222b8ecd88347e2dad57d675a8c8c624e6cc7f62699d2b7362e9b57ff24c994a5c5699c4190f910555568916b0249f2

Download Submit
/data/data/com.timber.funny/app_DynamicOptDex/oat/oQXZESo.json.cur.prof

Filesize
390B

MD5
5baf2d4e57f8b285c3d68326260bc08b

SHA1
3365809b64d6c8f5869733e383f83cd3ba3a0035

SHA256
8c2d45716a1c42c931d86aa695b17c4a578ea2c3b24348474f0c337b4b05b088

SHA512
074fd8730d9cf28463615256abe89393690575dd7608adbccf743f28ec9a20c4070a6e3014e87fe36ad0454c40d051184cd2c5473fb9e8287698ee6275d20892

Download Submit
/data/user/0/com.timber.funny/app_DynamicOptDex/oQXZESo.json

Filesize
483KB

MD5
09485d0ae12ab18d75eb0ca54efbf49c

SHA1
f2daa5007a2479ee78c74e8f9eb013b946b9962d

SHA256
bc51d9fc51b0045e126dbb438b481b6808218cde64ec3fb51d3267d3212f79c4

SHA512
8d94715a8c019914628e911658ce1f17df8924c76d3e963004891040953c8c51d514cc89f9029a00119b0a06e7cb38830e5287096426e0399095c49622398be4

Download Submit