alienbot | fad5a42794df59ae548d558c5a04b751046c53d7d1446208887cf4d4688d1503

Analysis

max time kernel
3128825s
max time network
161s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
30-12-2023 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08f4cc782fab3dc51f5ea00d3501550b.apk
Size

3.4MB
MD5

08f4cc782fab3dc51f5ea00d3501550b
SHA1

5cf3394a994d652b120701ab2d88b4d552f1089e
SHA256

fad5a42794df59ae548d558c5a04b751046c53d7d1446208887cf4d4688d1503
SHA512

7962ac61736fa26b98bfdaab75c7e55bf1d1e68a5ae599cec4d270083a8ae9a557c611dfc4ec2e41d27d9f1971349ddaa59d6acd6c542cdbad86740112f06d87
SSDEEP

49152:0xtW2r/hmkAe5MvvoaKCjJnneSZWM3d5N+esHSd98hZxoDIo8FRmsx7gn0OrlESS:0iW/0g2XxVjJnlSu9yZ69s7SlEr

Score

10^/10

alienbot banker infostealer stealth trojan

Malware Config

Extracted

Family

alienbot

http://bua591qkf2xx.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

sense.hesitate.plenty

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	sense.hesitate.plenty
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	sense.hesitate.plenty
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	sense.hesitate.plenty

Removes its main activity from the application launcher 3 IoCs
stealth trojan

Processes:

sense.hesitate.plenty

pid process

5002 sense.hesitate.plenty
5002 sense.hesitate.plenty
5002 sense.hesitate.plenty
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

sense.hesitate.plenty

ioc pid process

/data/user/0/sense.hesitate.plenty/app_DynamicOptDex/TBxzmSYVehxRc.json 5002 sense.hesitate.plenty
Acquires the wake lock 1 IoCs

Processes:

sense.hesitate.plenty

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock sense.hesitate.plenty

pid	process
5002	sense.hesitate.plenty
5002	sense.hesitate.plenty
5002	sense.hesitate.plenty

ioc	pid	process
/data/user/0/sense.hesitate.plenty/app_DynamicOptDex/TBxzmSYVehxRc.json	5002	sense.hesitate.plenty

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	sense.hesitate.plenty

sense.hesitate.plenty
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
PID:5002

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/sense.hesitate.plenty/app_DynamicOptDex/TBxzmSYVehxRc.json

Filesize
616KB

MD5
2adcfb1796b409b47703964925b5a640

SHA1
416222bf80a2543ccbe2b5e18e6eddd464858ce5

SHA256
5b297381ea99c48202c841891c2bbcd625c4357e47b13917b539ffb00a6a091c

SHA512
550db659600be24b3b1cef5e198315c0e12806b94c8ec3904ebcb9c7ddabde4ee816b8bc6408febb942f28b8f7317e7cf4be0ef7b61a9879fb1a4688878498a8

Download Submit
/data/data/sense.hesitate.plenty/app_DynamicOptDex/TBxzmSYVehxRc.json

Filesize
616KB

MD5
da2a4775756b2f80636faff757ecc35c

SHA1
d73c82d8c2eff3f96092f5636ffc51b3ba835315

SHA256
d2e470475fe5565d968ddbe11124220a2e9217a884e3f19323e8d1d1f950c898

SHA512
870900886509a0228bd4ff95d120162959bbb848749796f6127e777d8e2bad2859e62080975ea5c69a140cf722f6e4b276f207c04296cd32d91a0cdb2227ba4f

Download Submit
/data/data/sense.hesitate.plenty/app_DynamicOptDex/oat/TBxzmSYVehxRc.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/sense.hesitate.plenty/app_DynamicOptDex/TBxzmSYVehxRc.json

Filesize
767KB

MD5
083886b29550a95ecba6505cb6c1b3cb

SHA1
209c97536a61b2cbf609eb9d564871dc58a7eda0

SHA256
f5e056cc31145a6981e058dd73ce6b259f63d9ec44eba9a38917864a161ac544

SHA512
794b29bb617140525024897e8ae48020b1be21f110839bfbd5c6be823429e6eb44a58978906090a9e9f3bdd9f3cde22edfd08d1de9bbdb6ae736b01e51ef7350

Download Submit