alienbot | 1a79724595a99052723f2422d57ec93b1f62e1cdb2121ae9ae2175b107e60a00

General

Target

74ff2c72c16aa2909fdb5adbb83f122b.apk
Size

4.3MB
MD5

74ff2c72c16aa2909fdb5adbb83f122b
SHA1

eafc99acfb4757ee27bce2b2bbac0e08bd6f6b52
SHA256

1a79724595a99052723f2422d57ec93b1f62e1cdb2121ae9ae2175b107e60a00
SHA512

f3b3e8d3e96c54c49963c57d009c1bf0fc5993c208fb715630490f1a724efdeffd3f39b4dd7fad2135c81b0b511334bf64d57e5f513c8902f6ebcecbf03644bc
SSDEEP

98304:eiyySaTQmA1mTEw07N01PtM2G2LqUrSUjvbLqs50MISGhGv3Jn:cyS/CTEtN6FvGLvKui3Jn

Score

10^/10

alienbot banker evasion infostealer stealth trojan

Malware Config

Extracted

Family

alienbot

C2

http://vgokkycl61ck.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

diabetes.circuit.opposition

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	diabetes.circuit.opposition
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	diabetes.circuit.opposition
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	diabetes.circuit.opposition

Removes its main activity from the application launcher 3 IoCs
stealth trojan

Processes:

diabetes.circuit.opposition

pid process

4242 diabetes.circuit.opposition
4242 diabetes.circuit.opposition
4242 diabetes.circuit.opposition

pid	process
4242	diabetes.circuit.opposition
4242	diabetes.circuit.opposition
4242	diabetes.circuit.opposition

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/diabetes.circuit.opposition/app_DynamicOptDex/MgOBSlNYKumnT.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/diabetes.circuit.opposition/app_DynamicOptDex/oat/x86/MgOBSlNYKumnT.odex --compiler-filter=quicken --class-loader-context=&diabetes.circuit.opposition

ioc	pid	process
/data/user/0/diabetes.circuit.opposition/app_DynamicOptDex/MgOBSlNYKumnT.json	4267	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/diabetes.circuit.opposition/app_DynamicOptDex/MgOBSlNYKumnT.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/diabetes.circuit.opposition/app_DynamicOptDex/oat/x86/MgOBSlNYKumnT.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/diabetes.circuit.opposition/app_DynamicOptDex/MgOBSlNYKumnT.json	4242	diabetes.circuit.opposition

Acquires the wake lock 1 IoCs

Processes:

diabetes.circuit.opposition

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock diabetes.circuit.opposition
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

diabetes.circuit.opposition

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS diabetes.circuit.opposition

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	diabetes.circuit.opposition

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	diabetes.circuit.opposition

diabetes.circuit.opposition
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4242
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/diabetes.circuit.opposition/app_DynamicOptDex/MgOBSlNYKumnT.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/diabetes.circuit.opposition/app_DynamicOptDex/oat/x86/MgOBSlNYKumnT.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4267

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/diabetes.circuit.opposition/app_DynamicOptDex/MgOBSlNYKumnT.json

Filesize
616KB

MD5
273406afe24fcdee96153fce14d82b6f

SHA1
d855da7ec8f9a050c27d1a3c81fb3895661ee9f7

SHA256
37ab0f8ade5519d7afb299ba5b1a7786d9dd29d29f2552bcc7e6ad0545aefb9c

SHA512
06adb8f48cb3b598a35ecc98b88574776047e190710a64c003b4b2810c532b33c7bf930b88b341894bf1255ff6cac9859f5a898fd0ddc1a403f9d1707a27c2e2

Download Submit
/data/data/diabetes.circuit.opposition/app_DynamicOptDex/MgOBSlNYKumnT.json

Filesize
616KB

MD5
47d98dc2878c844a49f64ced70127ef7

SHA1
f70f36c6523da3c2eed2f6c098ffbcd4cfe64840

SHA256
27a07a97d1cd87e06fcde905c11e70837f5946f65a1f04fc807ad5a019d34c03

SHA512
a47e2e070de2b9f62f536e8a5991c9e5bd21401ac002efcb72faa9578a2b668e48bacf08f142b227f0936ea70932e48a3abc29e01b2fe56c0d663d99df188517

Download Submit
/data/data/diabetes.circuit.opposition/app_DynamicOptDex/oat/MgOBSlNYKumnT.json.cur.prof

Filesize
1KB

MD5
72e0b09e2a5c89f0c496ad7fe7be1d15

SHA1
34c8e39eb1d545ba0eccefb8cdb7c3e204083931

SHA256
1badc4179273547b52afef4a4775fa1978ddbe5f7025ee10e6699692dd77fda9

SHA512
0386096fe093d40cfda3bc6296f012231fddd2e201880c14fca1f2510e7f37f4c2403d8a60ba17b8e2bc449b0c73fe267bd7754b50ab8ccd2fb12d5d190edbbf

Download Submit
/data/user/0/diabetes.circuit.opposition/app_DynamicOptDex/MgOBSlNYKumnT.json

Filesize
767KB

MD5
276096bb2e7f6af34608ca5e851c9f28

SHA1
8152c6f8875e241031b6272a90f44de751477dad

SHA256
47e38cd4a79d600d99795c49cd7803536d973b5184642cd0b8ea50892f8e5d53

SHA512
2d825bdaaa8647799cd743c81578bf0f53d21e83040ec149576d9401f771d4f28ae225f58392dbd0a0ab54473bbb1d2b1d899d44d66249e020ecbbb1cdd10dc7

Download Submit
/data/user/0/diabetes.circuit.opposition/app_DynamicOptDex/MgOBSlNYKumnT.json

Filesize
767KB

MD5
f1e486f50ae2b084c0631187171c56c1

SHA1
75703853a7a55c9187872b29fc359c5440de95f3

SHA256
d962ae29e56819a799250de6a6141b0767f805360296c1b2464728e892a0b551

SHA512
7a28eefcda443cb0ff5dccb6bcd72676590da4ff7f293f316cf8facb2f4a29a356ca36f0e675a5cb7dbba7bb781862037293d1420f4d729cf25518be81432fb1

Download Submit

Analysis

Sharing