alienbot | ac2cb2c60ede6b43143cf2b98d56932d3f5c97aee0c5f4319e5539203cece079

General

Target

493b35f8fae4f4d06e36e98082560f4f.apk
Size

3.6MB
MD5

493b35f8fae4f4d06e36e98082560f4f
SHA1

eff6ed1e028eef7e7d987b6e14c44ac3a828629a
SHA256

ac2cb2c60ede6b43143cf2b98d56932d3f5c97aee0c5f4319e5539203cece079
SHA512

f41399a73a4169218564de4bae3f54cb6886d90f4b6d35200ee48ac3a3f11ace2c5f73fc08047c42f727618ac536f7354cf6ae1605e21537f486712b3691a04d
SSDEEP

98304:moYHqJY+PhhqidZzR8sD3p3uq/ZAl8lEDw:QEPh8idZV8sD3FTZq6Gw

Score

10^/10

alienbot banker evasion infostealer stealth trojan

Malware Config

Extracted

Family

alienbot

C2

http://rndhsadjersxexdd.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

garden.Soviet.carbon

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	garden.Soviet.carbon
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	garden.Soviet.carbon
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	garden.Soviet.carbon

Removes its main activity from the application launcher 2 IoCs
stealth trojan

Processes:

garden.Soviet.carbon

pid process

4268 garden.Soviet.carbon
4268 garden.Soviet.carbon

pid	process
4268	garden.Soviet.carbon
4268	garden.Soviet.carbon

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/garden.Soviet.carbon/app_DynamicOptDex/YWUALlpGNxnCqPA.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/garden.Soviet.carbon/app_DynamicOptDex/oat/x86/YWUALlpGNxnCqPA.odex --compiler-filter=quicken --class-loader-context=&garden.Soviet.carbon

ioc	pid	process
/data/user/0/garden.Soviet.carbon/app_DynamicOptDex/YWUALlpGNxnCqPA.json	4294	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/garden.Soviet.carbon/app_DynamicOptDex/YWUALlpGNxnCqPA.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/garden.Soviet.carbon/app_DynamicOptDex/oat/x86/YWUALlpGNxnCqPA.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/garden.Soviet.carbon/app_DynamicOptDex/YWUALlpGNxnCqPA.json	4268	garden.Soviet.carbon

Acquires the wake lock 1 IoCs

Processes:

garden.Soviet.carbon

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock garden.Soviet.carbon
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

garden.Soviet.carbon

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS garden.Soviet.carbon

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	garden.Soviet.carbon

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	garden.Soviet.carbon

garden.Soviet.carbon
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4268
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/garden.Soviet.carbon/app_DynamicOptDex/YWUALlpGNxnCqPA.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/garden.Soviet.carbon/app_DynamicOptDex/oat/x86/YWUALlpGNxnCqPA.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4294

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/garden.Soviet.carbon/app_DynamicOptDex/YWUALlpGNxnCqPA.json

Filesize
564KB

MD5
064ae709730531e65fd80a8791844fb7

SHA1
20b8cda6e62dfa0aba44fdc936c7ee8c7061c637

SHA256
9a797a8cd64479d60a20f3da5bcbb559a7f2f58a6971168f54d0891602d34144

SHA512
0ef0b33792b95de3b2b3477d3a08f4daad60ff3ba530500e83c7d4493b690dbe8f684dfe05657f1aa543b25a0ca857d2bdbb0aa7f39daec6af25ba58512f041a

Download Submit
/data/data/garden.Soviet.carbon/app_DynamicOptDex/YWUALlpGNxnCqPA.json

Filesize
564KB

MD5
bf59cb30d338df86aaa65cd50c43e25d

SHA1
4f97395f5a69064b607c02482433b465d1167dee

SHA256
d4e3e821645974f5fd9b028ef0ba570476076bcc5193aa37cd221553f94d4fef

SHA512
477955e47f0d9a6f390e47aa31ba0816aa3f0196be9d47ba02057eeaf2fdd41c7f110d678251c1b44f46f75da34095977e5add69654fa039d00ddb347b94ab03

Download Submit
/data/data/garden.Soviet.carbon/app_DynamicOptDex/oat/YWUALlpGNxnCqPA.json.cur.prof

Filesize
1KB

MD5
c96c16a50fe2e7658e28b488a809dc65

SHA1
6eac13a83f7399d81bf0db173e583bfb267025e2

SHA256
ef477901116999da5663fe19286610a6136d55b00db5e63bbd502c67e4178a62

SHA512
ece5e31a8c52e2b1d08b9b4c978e3e338a5e4349a03813d35475635b070e86cf159dc7bb456c242417d4e9987c98de04deaee7c325371e4823c5e9b3dfdff3fd

Download Submit
/data/user/0/garden.Soviet.carbon/app_DynamicOptDex/YWUALlpGNxnCqPA.json

Filesize
767KB

MD5
b253a4b7c84dd415085d256a5023037a

SHA1
f2a04ec92d580918279f6f68b8002cb2524957f6

SHA256
f7633a3c721aee3cb17d6e1a163698b12f84fd4462e54bc85e3bc85189f85879

SHA512
887699695644c262024e08e62df3b529a6c0cf39841fb4d89c9167c38dae644c8cef091c63aa1c444f623041e38a0a2c88ae5f3230d59687b1b9a2cda295a755

Download Submit
/data/user/0/garden.Soviet.carbon/app_DynamicOptDex/YWUALlpGNxnCqPA.json

Filesize
767KB

MD5
6427b5bc340dd58e0e0760cf41741e6d

SHA1
7abfe8b374fcc4bf262226e7a8370bcffb3f852f

SHA256
2b0b3be826276b792d4851b118b0faaa2d563fe239a83dc74e2c8a0501534255

SHA512
caf892e863acb34d98624d928a4d7d7657c67d84078d4b6ba5288b631c69c143fd025cd1aa911c790456307e9460bc33a67f70eb3dafb80d0b75091ac76a5ac8

Download Submit

Analysis

Sharing