alienbot | e42988084f6d064c900d922f374a33fdbbefa14fd420ce1df1d5d632b851f560

Analysis

max time kernel
2786790s
max time network
155s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
24-12-2023 06:07

Target

e42988084f6d064c900d922f374a33fdbbefa14fd420ce1df1d5d632b851f560.apk
Size

3.6MB
MD5

a7800a5e355a0adc53c6ebcea6fa9a08
SHA1

f3da3c9707625acb37971452262b158739e243c5
SHA256

e42988084f6d064c900d922f374a33fdbbefa14fd420ce1df1d5d632b851f560
SHA512

0d24cb353da3b942a43ea6fe35f55febc3254fa64062cac4c9c1afb43cbaf6318f7c5fdde63c276aeadabb0e4ef5db8a8e9dba80dca8ea9d36b4f08a28413330
SSDEEP

98304:llhFH/oe6k2esxFH/6KbMCv/XEB6NFOw2Ycb9fP:xqE2BxFCK4w/XqwV2Yc5X

Score

10^/10

Family

alienbot

http://bilmem23x.digital

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 1 IoCs

Processes:

resource	yara_rule
/data/data/call.toward.black/app_DynamicOptDex/DE.json	family_cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

call.toward.black

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	call.toward.black
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	call.toward.black

Removes its main activity from the application launcher 8 IoCs

Processes:

call.toward.black

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

call.toward.black

ioc	pid	process
/data/user/0/call.toward.black/app_DynamicOptDex/DE.json	4914	call.toward.black
/data/user/0/call.toward.black/app_DynamicOptDex/DE.json	4914	call.toward.black

/data/data/call.toward.black/app_DynamicOptDex/DE.json

Filesize
728KB

MD5
3e835dea8eb7ec72ce233a64fb033e70

SHA1
021d92b8c01ef611542ba1f34e92c2cc37c75eff

SHA256
98c4c65e8083ceb7bf204c4959e7d290a1d4401686f06f226a62734da4138b7d

SHA512
5946ed63e2e36817303d1b01cadb1566df11706a1bf2750708494e89b88b3b4348e3cb609a750883238a3c14f1b4338a75af3739704726bdb6fc1a19f392549b

Download Submit
/data/data/call.toward.black/app_DynamicOptDex/DE.json

Filesize
728KB

MD5
1bf3ddfe0d4044dee52234e6eb7cc925

SHA1
ad646c5b50e4050ca5b79b3360cd9e1bb84ddc9e

SHA256
4de189e1fdc6d8305a20c8aa9a7420d106c5d8dd0fd1d3a5f06142eb15721c08

SHA512
cee67c49817b34dff8899001728b7aa932bc108a23c3d352e905fdeae650459f1be68a3642700ad2d9834b06d567f5018a7c48540ecb7aab8eea1321dabfabe5

Download Submit
/data/data/call.toward.black/app_DynamicOptDex/oat/DE.json.cur.prof

Filesize
438B

MD5
6eb52bd0a740aaedeae493822e8dbb71

SHA1
1a0cdf3594deb4c04db4741e3dd82cc3530cf358

SHA256
ca057ab4620a3caefe811153a321b9c5d753176b37fc8f0668a51ea2abc68072

SHA512
a766092700c7dee59be854c78607ef0863989d6048ade10b7bfc26c56598205a6ded7834251e26a487733f2410a91cd104f9ea3ee5490b653c4ef0c91d23d5e7

Download Submit