alienbot | fad5a42794df59ae548d558c5a04b751046c53d7d1446208887cf4d4688d1503

General

Target

08f4cc782fab3dc51f5ea00d3501550b.apk
Size

3.4MB
MD5

08f4cc782fab3dc51f5ea00d3501550b
SHA1

5cf3394a994d652b120701ab2d88b4d552f1089e
SHA256

fad5a42794df59ae548d558c5a04b751046c53d7d1446208887cf4d4688d1503
SHA512

7962ac61736fa26b98bfdaab75c7e55bf1d1e68a5ae599cec4d270083a8ae9a557c611dfc4ec2e41d27d9f1971349ddaa59d6acd6c542cdbad86740112f06d87
SSDEEP

49152:0xtW2r/hmkAe5MvvoaKCjJnneSZWM3d5N+esHSd98hZxoDIo8FRmsx7gn0OrlESS:0iW/0g2XxVjJnlSu9yZ69s7SlEr

Score

10^/10

alienbot banker evasion infostealer stealth trojan

Malware Config

Extracted

Family

alienbot

C2

http://bua591qkf2xx.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

sense.hesitate.plenty

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	sense.hesitate.plenty
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	sense.hesitate.plenty
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	sense.hesitate.plenty

Removes its main activity from the application launcher 2 IoCs
stealth trojan

Processes:

sense.hesitate.plenty

pid process

4269 sense.hesitate.plenty
4269 sense.hesitate.plenty

pid	process
4269	sense.hesitate.plenty
4269	sense.hesitate.plenty

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/sense.hesitate.plenty/app_DynamicOptDex/TBxzmSYVehxRc.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/sense.hesitate.plenty/app_DynamicOptDex/oat/x86/TBxzmSYVehxRc.odex --compiler-filter=quicken --class-loader-context=&sense.hesitate.plenty

ioc	pid	process
/data/user/0/sense.hesitate.plenty/app_DynamicOptDex/TBxzmSYVehxRc.json	4294	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/sense.hesitate.plenty/app_DynamicOptDex/TBxzmSYVehxRc.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/sense.hesitate.plenty/app_DynamicOptDex/oat/x86/TBxzmSYVehxRc.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/sense.hesitate.plenty/app_DynamicOptDex/TBxzmSYVehxRc.json	4269	sense.hesitate.plenty

Acquires the wake lock 1 IoCs

Processes:

sense.hesitate.plenty

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock sense.hesitate.plenty
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

sense.hesitate.plenty

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS sense.hesitate.plenty

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	sense.hesitate.plenty

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	sense.hesitate.plenty

sense.hesitate.plenty
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4269
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/sense.hesitate.plenty/app_DynamicOptDex/TBxzmSYVehxRc.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/sense.hesitate.plenty/app_DynamicOptDex/oat/x86/TBxzmSYVehxRc.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4294

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/sense.hesitate.plenty/app_DynamicOptDex/TBxzmSYVehxRc.json

Filesize
616KB

MD5
2adcfb1796b409b47703964925b5a640

SHA1
416222bf80a2543ccbe2b5e18e6eddd464858ce5

SHA256
5b297381ea99c48202c841891c2bbcd625c4357e47b13917b539ffb00a6a091c

SHA512
550db659600be24b3b1cef5e198315c0e12806b94c8ec3904ebcb9c7ddabde4ee816b8bc6408febb942f28b8f7317e7cf4be0ef7b61a9879fb1a4688878498a8

Download Submit
/data/data/sense.hesitate.plenty/app_DynamicOptDex/TBxzmSYVehxRc.json

Filesize
616KB

MD5
da2a4775756b2f80636faff757ecc35c

SHA1
d73c82d8c2eff3f96092f5636ffc51b3ba835315

SHA256
d2e470475fe5565d968ddbe11124220a2e9217a884e3f19323e8d1d1f950c898

SHA512
870900886509a0228bd4ff95d120162959bbb848749796f6127e777d8e2bad2859e62080975ea5c69a140cf722f6e4b276f207c04296cd32d91a0cdb2227ba4f

Download Submit
/data/data/sense.hesitate.plenty/app_DynamicOptDex/oat/TBxzmSYVehxRc.json.cur.prof

Filesize
1KB

MD5
863feff5ef2564839b1e8ded9664fd5d

SHA1
58ffc5763f124a0ba7c236e6f67109fe15f87921

SHA256
ee235d34bf858a5e10e11710fd53f93ed1e799e94648eb5bce6ad0b43a2d0a36

SHA512
9eaddc7bcf38a04f2dbcf96a9675570b5114291642d1f6a7785ff613678ec62de0e3a4cec4985eb7ae0bc70fc5c5481c7182cef40a0ff4139122a861f9655286

Download Submit
/data/user/0/sense.hesitate.plenty/app_DynamicOptDex/TBxzmSYVehxRc.json

Filesize
767KB

MD5
891c1cad966e36fb68a14bfa73dd1a52

SHA1
6f5357a5c07ce2ae8849f3214b721ea315b6d003

SHA256
046eecb4b6350c2f851df0129dc04c544e4317f3080025a5d565edfd95b0776a

SHA512
8b7f713999798a67411abaad66b5146d1c9b5a505b5ac51bb6b573d07b639f13919137399a63759902e76cca3890407a9dfc1a5df5bab1e0444b09f6e8bb317e

Download Submit
/data/user/0/sense.hesitate.plenty/app_DynamicOptDex/TBxzmSYVehxRc.json

Filesize
767KB

MD5
083886b29550a95ecba6505cb6c1b3cb

SHA1
209c97536a61b2cbf609eb9d564871dc58a7eda0

SHA256
f5e056cc31145a6981e058dd73ce6b259f63d9ec44eba9a38917864a161ac544

SHA512
794b29bb617140525024897e8ae48020b1be21f110839bfbd5c6be823429e6eb44a58978906090a9e9f3bdd9f3cde22edfd08d1de9bbdb6ae736b01e51ef7350

Download Submit

Analysis

Sharing