alienbot | 796c74ea79739416cd8133bd9256940dee9f390d0c787fa099265bfdd58497b6

Analysis

max time kernel
152s
max time network
147s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
25-01-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

796c74ea79739416cd8133bd9256940dee9f390d0c787fa099265bfdd58497b6.apk
Size

3.8MB
MD5

318ae2a5c186ff65a1bc483a5ede88d5
SHA1

b30970730747d51d531bf8d500a6436e2d7aa03c
SHA256

796c74ea79739416cd8133bd9256940dee9f390d0c787fa099265bfdd58497b6
SHA512

c8ab93098501ead34cb51e3a31ad083e1e9f838b49f55946d7b5befbc6aca84b78e9a080000635d1a7c6e4a8025fa5db61217209c57c480990dffdd8cfcd9a92
SSDEEP

98304:o3Pe1gOLPQsM+pU/5lF5/3/n9Ujs6avJ5wzmXY4X8gWRQ:0Q7P7S/5xt685w/08i

Score

10^/10

alienbot banker infostealer trojan

Malware Config

Extracted

Family

alienbot

http://wf4sctx9cksg94528o7o.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

com.guideline.direct

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.guideline.direct
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.guideline.direct
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.guideline.direct

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.guideline.direct

ioc pid process

/data/user/0/com.guideline.direct/app_DynamicOptDex/oPVh.json 4962 com.guideline.direct
Acquires the wake lock 1 IoCs

Processes:

com.guideline.direct

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.guideline.direct

ioc	pid	process
/data/user/0/com.guideline.direct/app_DynamicOptDex/oPVh.json	4962	com.guideline.direct

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.guideline.direct

com.guideline.direct
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Acquires the wake lock
PID:4962

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.guideline.direct/app_DynamicOptDex/oPVh.json

Filesize
661KB

MD5
813dfe3754186f32dd9b994be1b7b522

SHA1
d78341ba106fe53f63ed8af639dfffe79a550e3b

SHA256
8152d63109d11313c1b1b85a7a99abe47151b353d44f718d07e8bffd01098f7f

SHA512
33959faf48df862a81b04f24fd3d0bdb6f15cac1726216becc87706e873ab174e7b038a97ad33903439cb836b8c3652f5f5c457ae133bc70a2f8dc4227ef4e0b

Download Submit
/data/data/com.guideline.direct/app_DynamicOptDex/oPVh.json

Filesize
661KB

MD5
395325c0530020f64cda56408f77b063

SHA1
33dd3152b5b2d88f0aee67e8a8410ed7a9c72b6e

SHA256
3705e32f6f24c08d987cd6d4561812899461fa2041ef067083d55f3960259bf7

SHA512
b27e12e04ef68a5f6e10a7d05666a2a3fdc4f89341b1eb4d12695d13201e278a3e12819f9be4a5ccc30e78941a425648968b2911f9c5934cecf3ea7c3caab7df

Download Submit
/data/data/com.guideline.direct/app_DynamicOptDex/oat/oPVh.json.cur.prof

Filesize
467B

MD5
e3bfa6f8d7075a926fa9e77dfa6e7400

SHA1
88c1825e93b8dc484951c094c11835152af73575

SHA256
2be84dcc8502adf91a6ca1a2cb1230643ae6ed5ec926ff2b2c037566e5c7a60f

SHA512
9c17296218a02bc348d17dc9f05e3ca74a4ebc0fc05afc118047ae6e907d173f8603db101a465af18b9861f5d5649a0a579a85835df9f4565f314709d2612a57

Download Submit
/data/user/0/com.guideline.direct/app_DynamicOptDex/oPVh.json

Filesize
903KB

MD5
7021ce86451bd29cc3b3e5e7d3201dfb

SHA1
0c5d31785427e945ee68838c9100ee7ab6f60797

SHA256
b99152b673b5306043b999194a09d743117db3709e67ef84477f10349ffdc532

SHA512
4aaea21c4f58be48b64f10e6b49b0625d2ec1e7dedce03485d8e60b4423e0a64aa8ae54840ce878d93001cac9dcb1b92df6af2c932150353e876ed82cba48cf5

Download Submit