alienbot | 7dcb987d39106ebb91cde38cdb87e43377963014722a4d49b2c49370ad54ae82

Analysis

max time kernel
2341213s
max time network
147s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
20-12-2023 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dcb987d39106ebb91cde38cdb87e43377963014722a4d49b2c49370ad54ae82.apk
Size

2.4MB
MD5

3516d7b0d815d8c48dd6785c1b885e4c
SHA1

af9d581f7ab4871c6dde28e0bd277ac370e67396
SHA256

7dcb987d39106ebb91cde38cdb87e43377963014722a4d49b2c49370ad54ae82
SHA512

ddcedf17501d7c5fd004c32d377cf8429bc116acda3c9b5ab0928f757072bd7a7e75b050d601f3fd18549bb5804373d047704c68763beaaaf6c31e1b15c10040
SSDEEP

49152:i6WLvEZiJwF2RF0t+XwSCiS8ckt2fd6yQW1s6/GNsTZZZZdZROlGNkWFBJdfSbHu:5NdNiS8cOXcG0ZZZZdX6W/Jdf1

Score

10^/10

alienbot cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://perohi21.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_cerberus
behavioral1/memory/4246-1.dex	family_cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4246	lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei/app_DynamicOptDex/Kyk.json	4246	lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei
/data/user/0/lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei/app_DynamicOptDex/Kyk.json	4270	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei/app_DynamicOptDex/Kyk.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei/app_DynamicOptDex/oat/x86/Kyk.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei/app_DynamicOptDex/Kyk.json	4246	lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei

lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4246
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei/app_DynamicOptDex/Kyk.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei/app_DynamicOptDex/oat/x86/Kyk.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4270

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei/app_DynamicOptDex/Kyk.json

Filesize
741KB

MD5
9a50331ca013d3490f29a6d332394abb

SHA1
0a41cedc0a8288a2ba1b8ec2c8fcc48ccc061fcb

SHA256
136a06e4d715455a817a70ab6b8162e187b224e11041a73b5e14e9ea6d8d3551

SHA512
d004b02652ae4c260aaa71fc6a771fd1e4281166e24860f5db34e0bc8f38de826220064325ecde28fd4824d6c0a05b6b8f7dac3e3de5f551c45a645f949d1398

Download Submit
/data/data/lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei/app_DynamicOptDex/Kyk.json

Filesize
741KB

MD5
5eec4c66cd3b761348a9a8dc665afd6a

SHA1
f1d8c01316c5d522ff2e1847835a6b5ee8cd50bb

SHA256
ee39b5b0bd3584c8e5ee8ac84e97887323f7cb7fb336b3c54fac18b7e8f20747

SHA512
319cfba47d0111c02de98454c64931d1e7827aa8a2912d6d836f52d6bf0ef710ed9ca4ef8aa51eab18e1467ada87a1ca7c072bbacde4d04607a7317146e396be

Download Submit
/data/data/lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei/app_DynamicOptDex/oat/Kyk.json.cur.prof

Filesize
461B

MD5
98df417412944924c982d826d29306b3

SHA1
25bb76e98c22cbc009fa41e9d19b4c9793fb5261

SHA256
e5fc637f80827bc9799b1631a71d7e270ad1a037f19e42eef2958fe99a476f38

SHA512
f9ecf2fead9fc8ff4458173e56c8135ddd1cf8aeeb1f76f338eb97efd81afb72d9573e8b43344de3b937fc95bee88c1f3b7bcf8f06ef487f8898f4388da16c7a

Download Submit
/data/user/0/lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei/app_DynamicOptDex/Kyk.json

Filesize
741KB

MD5
20d06fa2f8821cbf95b9da668f827ebd

SHA1
458f57b15d6b446dfc9ab88459389defbebfb3dc

SHA256
93db4f215b53c70b0f5de0aa88739eef4f7bd788f60addc908689e8f2352339c

SHA512
decb82c7f3a9a6296b449071df6cbbee52b988b1475f845fccf0211384522157b3183f1151f31556195f018d51e874e0b466e0197724edb716f29f9a89fc9388

Download Submit