alienbot | 6303d0ea4311fa394008b6c9025ea432f5f50008687d40662d806a9790602b0e

Analysis

max time kernel
4030859s
max time network
150s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
09/01/2024, 22:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6303d0ea4311fa394008b6c9025ea432f5f50008687d40662d806a9790602b0e.apk
Size 3.3MB
Sample240109-1xefmaaaek
SHA256 6303d0ea4311fa394008b6c9025ea432f5f50008687d40662d806a9790602b0e
MD5 c87881f61bc910d3ea2f3d4a5d1a5441
SHA1 443205431f54a41558d92d930e0c18787f2fe85f
SHA512 bfa1df7da152b498503e30ee78d6ed557b752a629dc11402674580c895489b4ae87c18376c87fa73693dfb80e92cb7cc150a362d28edf4b4d3d36932619b8602
SSDEEP 98304:q4p3pFvQy78F2y/xLDoMu2wYIromgnWRC:q41F784y/hxuXBrgWRC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

alienbot cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://guiopl.ga

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 1 IoCs

resource	yara_rule
behavioral2/memory/4963-0.dex	family_cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	twice.wheat.ceiling
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	twice.wheat.ceiling

Removes its main activity from the application launcher 7 IoCs

stealth trojan

pid	Process
4963	twice.wheat.ceiling
4963	twice.wheat.ceiling
4963	twice.wheat.ceiling
4963	twice.wheat.ceiling
4963	twice.wheat.ceiling
4963	twice.wheat.ceiling
4963	twice.wheat.ceiling

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/twice.wheat.ceiling/app_DynamicOptDex/WFnOKW.json	4963	twice.wheat.ceiling
/data/user/0/twice.wheat.ceiling/app_DynamicOptDex/WFnOKW.json	4963	twice.wheat.ceiling

twice.wheat.ceiling
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
PID:4963

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

WFnOKW.json

Path /data/data/twice.wheat.ceiling/app_DynamicOptDex/WFnOKW.json
Size 688KB
SHA256 06cf80e5e582fcc9c2cc062f7916712fd49fb972fbfaae8b8c81fd56e9de4d62
MD5 9f0aaa55342abf6283c6153130ac57b3
SHA1 3680269cfc230c72c7c89ba5aafb58b7d30a55fc
SHA512 61251b09c3f652c6d4bf48ec66be5a00e44f3a7c59594ab27cd0520eee75af5f2e3680602eac3c22a154d1740ad7a8a0a2366ed6fc9ba1a82c4dc05da78864a5
SSDEEP 12288:RT99A7na+0gzyrMw6KyvE56NBfYW/mC5/m/h0JuW3DNS9yndHuk10+cV5mPqJtA6:RTfA7avsyJ6lE5gwRCU/li3HB174mqJp
MD5 SHA1 SHA512 SSDEEP

Submit Download

WFnOKW.json.cur.prof

Path /data/data/twice.wheat.ceiling/app_DynamicOptDex/oat/WFnOKW.json.cur.prof
Size 392B
SHA256 d2d9ed63c88492d618ba330d45f64d5d05187ae896c763dcf3b064135c69db10
MD5 bbc2e713bf8903ae362228c0d4904534
SHA1 f6ebf3c6447d34c6adc15f4668e04912e06a026d
SHA512 6da4eea3f8bb2e9a98ebe165821bf0bd53ccb59eca9e53832c36613f9d875e14a1731218b9958e7f27e20299ec53eebd651a306b40a93f5d5e2c4201776d7e8a
MD5 SHA1 SHA512