alienbot | a92cc791f8e9f6cd619ce76033a62c10e8954310e8791b5fa581a806b8ab898c

Analysis

max time kernel
3161290s
max time network
159s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
30-12-2023 03:57

Target

0da3fc66004320774a0ff35d239b3aca.apk
Size

281KB
MD5

0da3fc66004320774a0ff35d239b3aca
SHA1

6c514307ee8791903f48938983bfafb616fa8a88
SHA256

a92cc791f8e9f6cd619ce76033a62c10e8954310e8791b5fa581a806b8ab898c
SHA512

1460f012d213002407622032a8dd36c98a6bacfd5194bc5d0d0b4f5dbdb98acab06696fd6e4d4147d784cab8924d55df7eaeb3134b0042572b2985361ea6840c
SSDEEP

6144:ylYXB3P9Em35L0JGiDWaYjtIR+UzvQNaAff0fEOmNdF2pW1s:OYXBlE8iDW1jtIR+MAcWNdF2R

Score

10^/10

Family

alienbot

http://abindizzobremin.tk

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

com.qvrgersr.auzbhei

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.qvrgersr.auzbhei
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.qvrgersr.auzbhei

Removes its main activity from the application launcher 8 IoCs

Processes:

com.qvrgersr.auzbhei

com.qvrgersr.auzbhei
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
PID:4984