alienbot | afa85eacbcb9e4cb13d962449663ca0060eae579b33e0806c9ddecdc8d095830

Analysis

max time kernel
3624907s
max time network
150s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
31-12-2023 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24b12a6b58a37dfa57a7563883efabea.apk
Size

2.8MB
MD5

24b12a6b58a37dfa57a7563883efabea
SHA1

0a93e315530ac6a65f701869bebfd48c7ca40486
SHA256

afa85eacbcb9e4cb13d962449663ca0060eae579b33e0806c9ddecdc8d095830
SHA512

e6ba864194558ee1afd82e2edf84412e76c45f3c4d31f07f241bf29fbedaceca855b29e31ef283ab536c7533e326218ccb3a3201634fc23e83fc29f7cfd77cf6
SSDEEP

49152:J8ujrWNGlYI9L9kjA5MtSRqzYsy6O7EHK35UPPCaBNNPfjElyDHp9nqHcnReiIQq:JkNahV5/UY9Dj2nnPTplKcnRHI3qm

Score

10^/10

alienbot cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://194.163.136.78

rc4.plain

Extracted

Family

alienbot

http://194.163.136.78

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json	family_cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

asset.margin.pipe

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	asset.margin.pipe
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	asset.margin.pipe

Removes its main activity from the application launcher 8 IoCs

stealth trojan

Processes:

asset.margin.pipe

pid	process
4616	asset.margin.pipe
4616	asset.margin.pipe
4616	asset.margin.pipe
4616	asset.margin.pipe
4616	asset.margin.pipe
4616	asset.margin.pipe
4616	asset.margin.pipe
4616	asset.margin.pipe

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

asset.margin.pipe

ioc	pid	process
/data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json	4616	asset.margin.pipe
/data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json	4616	asset.margin.pipe

Acquires the wake lock 1 IoCs

Processes:

asset.margin.pipe

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock asset.margin.pipe
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

asset.margin.pipe

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS asset.margin.pipe

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	asset.margin.pipe

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	asset.margin.pipe

asset.margin.pipe
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json

Filesize
685KB

MD5
1221a8143f5ba9aa97092d586920d054

SHA1
e53b302d47d078701bd3c096833d3cb4692749f2

SHA256
fa23ec08d24705deacb41545a3ca21779e2b1c0845dcd400d27ba2754eda2547

SHA512
53af00702725719d386685be945e943cdeb5d435deb9dd4a71ce4b3ab56a3e86efc4da6061ea56f8a82953617ead7f26047c1a32770e77ca70a4d8eb47424afa

Download Submit
/data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json

Filesize
685KB

MD5
f1184c0f3cd2fa70c590484035e9d32a

SHA1
76fa99121538d74ac89a9598f107e2c4ece7717f

SHA256
5d7cc286da591ab8f960570810260bda6dff78f51d5b03229841eb84f76ca434

SHA512
d17c2c61be6863e945fa514e9d7c1c6dbed1781baf35c8e630cc7c68608aec31f233f1fd2cdbcbeadffe0a0ffc479d06442fe263476691859036a8b78b32ae9c

Download Submit
/data/user/0/asset.margin.pipe/app_DynamicOptDex/oat/SgK.json.cur.prof

Filesize
368B

MD5
1905f1cb23fc1e6ab162442905ef6b67

SHA1
4959c6a32f9877e91068f52885b2dc3f4b87b560

SHA256
1b57bb9da2dea8c6dfcd29a2e6a5ec43e1eeda289e3a5d7043d4ad1fa5fa3ff2

SHA512
fec39fae5d2e19e80299d7e380e1a57e53d67e5787f54481d3c72aeae31271cd9f8065c0ac307942f9454bead3dc6383dd1d2419f4b17ceb1de658d39ae724f4

Download Submit