alienbot | 061a13193d6f743c67c486a64fe50be243132df2fb414ce01b554bf87ba871c5

Analysis

max time kernel
146s
max time network
155s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
25-01-2024 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

740cbd727edfa42ebd9ae6665c0a6c3b.apk
Size

2.9MB
MD5

740cbd727edfa42ebd9ae6665c0a6c3b
SHA1

55636ff9abfb78fa206bc5794021d92f5bebc8e0
SHA256

061a13193d6f743c67c486a64fe50be243132df2fb414ce01b554bf87ba871c5
SHA512

500a38a9f00cca61d43b9a10cb9f6f06bfdc62f35124ab898b8a71456d8ce8d390f9db9c81075d189a8995f21812865822c0135675bcc601980ba9fbdc244547
SSDEEP

49152:bUlFuZFJK2yF69IJS300TEXKJAkSn4fITJYpHfVex4E4k4x//zC1HrR+n0FAYVpQ:bUGKr09z300IXsWWITepuD4kqzC1HLAt

Score

10^/10

alienbot cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://193.70.91.231

rc4.plain

Extracted

Family

alienbot

http://193.70.91.231

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/host.meadow.inmate/app_DynamicOptDex/kDx.json	family_cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

host.meadow.inmate

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	host.meadow.inmate
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	host.meadow.inmate

Removes its main activity from the application launcher 8 IoCs

stealth trojan

Processes:

host.meadow.inmate

pid	process
4910	host.meadow.inmate
4910	host.meadow.inmate
4910	host.meadow.inmate
4910	host.meadow.inmate
4910	host.meadow.inmate
4910	host.meadow.inmate
4910	host.meadow.inmate
4910	host.meadow.inmate

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

host.meadow.inmate

ioc	pid	process
/data/user/0/host.meadow.inmate/app_DynamicOptDex/kDx.json	4910	host.meadow.inmate
/data/user/0/host.meadow.inmate/app_DynamicOptDex/kDx.json	4910	host.meadow.inmate

Acquires the wake lock 1 IoCs

Processes:

host.meadow.inmate

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock host.meadow.inmate

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	host.meadow.inmate

host.meadow.inmate
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
PID:4910

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/host.meadow.inmate/app_DynamicOptDex/oat/kDx.json.cur.prof

Filesize
500B

MD5
78108f45d6f65a33ce2b2be7c494f9bb

SHA1
edd92062eaf5c8c7c48273e5a0fc477ff3d2209d

SHA256
71ad64a47d8c9e38f47614558070662886d10b57fe280ba05c5c5b0da5dac04a

SHA512
860e7899d0121d261c33ced1bbd158d2beb409c4203ab5f06cafdd20b7e2992af89090cae961577952cb2cd0f3a2432201f36ccc7b2e61e32ec562a8d08a82db

Download Submit
/data/user/0/host.meadow.inmate/app_DynamicOptDex/kDx.json

Filesize
733KB

MD5
9e41d4c26bcb1f57f0769facdb640e87

SHA1
4ee36bface37742da0eb1eb0e21294a73289ca61

SHA256
c8cc402727a34c4d37969aeae3e3abc0e9e51f487b0f1b552017e3e9b8958e41

SHA512
e872a487b075edc1975e05c38567f6927b66808016a1b38a37614a32688bf68c498f9e157c11deb3eee6f3da848181036e394ae6f04ae256856de1a1003fd150

Download Submit