alienbot | afa85eacbcb9e4cb13d962449663ca0060eae579b33e0806c9ddecdc8d095830

Analysis

max time kernel
3624926s
max time network
147s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
31-12-2023 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24b12a6b58a37dfa57a7563883efabea.apk
Size

2.8MB
MD5

24b12a6b58a37dfa57a7563883efabea
SHA1

0a93e315530ac6a65f701869bebfd48c7ca40486
SHA256

afa85eacbcb9e4cb13d962449663ca0060eae579b33e0806c9ddecdc8d095830
SHA512

e6ba864194558ee1afd82e2edf84412e76c45f3c4d31f07f241bf29fbedaceca855b29e31ef283ab536c7533e326218ccb3a3201634fc23e83fc29f7cfd77cf6
SSDEEP

49152:J8ujrWNGlYI9L9kjA5MtSRqzYsy6O7EHK35UPPCaBNNPfjElyDHp9nqHcnReiIQq:JkNahV5/UY9Dj2nnPTplKcnRHI3qm

Score

10^/10

alienbot cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://194.163.136.78

rc4.plain

Extracted

Family

alienbot

http://194.163.136.78

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 1 IoCs

Processes:

resource	yara_rule
/data/data/asset.margin.pipe/app_DynamicOptDex/SgK.json	family_cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

asset.margin.pipe

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	asset.margin.pipe
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	asset.margin.pipe

Removes its main activity from the application launcher 8 IoCs

stealth trojan

Processes:

asset.margin.pipe

pid	process
4997	asset.margin.pipe
4997	asset.margin.pipe
4997	asset.margin.pipe
4997	asset.margin.pipe
4997	asset.margin.pipe
4997	asset.margin.pipe
4997	asset.margin.pipe
4997	asset.margin.pipe

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

asset.margin.pipe

ioc	pid	process
/data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json	4997	asset.margin.pipe
/data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json	4997	asset.margin.pipe

Acquires the wake lock 1 IoCs

Processes:

asset.margin.pipe

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock asset.margin.pipe

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	asset.margin.pipe

asset.margin.pipe
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
PID:4997

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/asset.margin.pipe/app_DynamicOptDex/SgK.json

Filesize
685KB

MD5
1221a8143f5ba9aa97092d586920d054

SHA1
e53b302d47d078701bd3c096833d3cb4692749f2

SHA256
fa23ec08d24705deacb41545a3ca21779e2b1c0845dcd400d27ba2754eda2547

SHA512
53af00702725719d386685be945e943cdeb5d435deb9dd4a71ce4b3ab56a3e86efc4da6061ea56f8a82953617ead7f26047c1a32770e77ca70a4d8eb47424afa

Download Submit
/data/data/asset.margin.pipe/app_DynamicOptDex/SgK.json

Filesize
685KB

MD5
f1184c0f3cd2fa70c590484035e9d32a

SHA1
76fa99121538d74ac89a9598f107e2c4ece7717f

SHA256
5d7cc286da591ab8f960570810260bda6dff78f51d5b03229841eb84f76ca434

SHA512
d17c2c61be6863e945fa514e9d7c1c6dbed1781baf35c8e630cc7c68608aec31f233f1fd2cdbcbeadffe0a0ffc479d06442fe263476691859036a8b78b32ae9c

Download Submit
/data/data/asset.margin.pipe/app_DynamicOptDex/oat/SgK.json.cur.prof

Filesize
414B

MD5
29c8213d8be6b5b5bd35f406fa08c343

SHA1
eb5fa75b5c6e7a662bb7708ba8fd486636433922

SHA256
473989338fd1aec301f3742ab4947984e292bd46b696b23eafee88b3aea2a2b9

SHA512
b0b1a06c68dcf9b8667b72f6b1c56cec0ddf51e9ec9c83c87f771650394e6792a42840d3c19a717f3e8cc194ab74711cc614bf84eec7415b5959e4659a4caa67

Download Submit