alienbot | c10a976dabb58f3ea812ed548287842a65903214ac1a92bf2d499f87787a50f8

General

Target

7c5e83a49bbe44113c444524cbe7124b.apk
Size

3.8MB
MD5

7c5e83a49bbe44113c444524cbe7124b
SHA1

3c03d0bfc54f5fccf029f14f9a996c70d4f16014
SHA256

c10a976dabb58f3ea812ed548287842a65903214ac1a92bf2d499f87787a50f8
SHA512

dee77a1910bb6e552aef192e1cca5fa02277db5fb79de8522735429baa8b3ec7b0dbcb03eaab707c441e01f52828d7828a7089dd37b05023ceaf80b57c7e877c
SSDEEP

98304:8Cu1BeWBFCXIaVzW8lOqX/31qbm8fGH7b/5:4I7dV1qGbbx

Score

10^/10

alienbot banker evasion infostealer stealth trojan

Malware Config

Extracted

Family

alienbot

C2

http://rndhsadjersxexdd.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

understanding.subsidy.questionnaire

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	understanding.subsidy.questionnaire
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	understanding.subsidy.questionnaire
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	understanding.subsidy.questionnaire

Removes its main activity from the application launcher 2 IoCs
stealth trojan

Processes:

understanding.subsidy.questionnaire

pid process

4254 understanding.subsidy.questionnaire
4254 understanding.subsidy.questionnaire

pid	process
4254	understanding.subsidy.questionnaire
4254	understanding.subsidy.questionnaire

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/understanding.subsidy.questionnaire/app_DynamicOptDex/SNxnXY.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/understanding.subsidy.questionnaire/app_DynamicOptDex/oat/x86/SNxnXY.odex --compiler-filter=quicken --class-loader-context=&understanding.subsidy.questionnaire

ioc	pid	process
/data/user/0/understanding.subsidy.questionnaire/app_DynamicOptDex/SNxnXY.json	4280	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/understanding.subsidy.questionnaire/app_DynamicOptDex/SNxnXY.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/understanding.subsidy.questionnaire/app_DynamicOptDex/oat/x86/SNxnXY.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/understanding.subsidy.questionnaire/app_DynamicOptDex/SNxnXY.json	4254	understanding.subsidy.questionnaire

Acquires the wake lock 1 IoCs

Processes:

understanding.subsidy.questionnaire

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock understanding.subsidy.questionnaire
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

understanding.subsidy.questionnaire

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS understanding.subsidy.questionnaire

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	understanding.subsidy.questionnaire

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	understanding.subsidy.questionnaire

understanding.subsidy.questionnaire
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4254
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/understanding.subsidy.questionnaire/app_DynamicOptDex/SNxnXY.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/understanding.subsidy.questionnaire/app_DynamicOptDex/oat/x86/SNxnXY.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/understanding.subsidy.questionnaire/app_DynamicOptDex/SNxnXY.json

Filesize
563KB

MD5
ed38674de2c76109cb0e993489b42ffc

SHA1
010886708c1c2d076c6f856561e7073ce2b5b98f

SHA256
ff812cae7494ff099e79bfc0e01e25fcf2b5b8aeb5d555aa53a0039410ae1812

SHA512
5c49cd218b159c09c45533eec43cdd49b17ba8d77f8f1eaacccacdf1b8c84b20e6bbf163b08e18fcca8f5ddd658143d238254d313fb15c125a48f0b15ed29381

Download Submit
/data/data/understanding.subsidy.questionnaire/app_DynamicOptDex/SNxnXY.json

Filesize
563KB

MD5
a74a31acd507a4a191947dd907a2001a

SHA1
88c72e9475dfe34043dce4f775a507048e0082d6

SHA256
581e446ed87c42f2d811856fd012733901e88e85d535fec173c1ea96ee0402c8

SHA512
65d4296135da67cdd165a477f9dcfbaa43c095b3b28070f7e80eabf0ac50a9b3c84118d2405690b15dfad61edf1ee52f7107e5dbdf7cddf5e969a2561b00b35b

Download Submit
/data/data/understanding.subsidy.questionnaire/app_DynamicOptDex/oat/SNxnXY.json.cur.prof

Filesize
1KB

MD5
fa3e129074bb8cba741ac4fe8d07b1bc

SHA1
06763c461e2a99bafa36ae51159bcfe9adc5b3f3

SHA256
3cf31469ac02ffd9bb25582ab184d607e8b8ecfa8eade758511308074171a9a0

SHA512
c984a58d6691c6aad1272bf2e62ffbf65c5f9869e6448c42035bb79ec0b26374acdcea80480a2230c4e35c8290532bbe3385c03d6b63fba9069fe5c1d7c81c00

Download Submit
/data/user/0/understanding.subsidy.questionnaire/app_DynamicOptDex/SNxnXY.json

Filesize
767KB

MD5
f162b202771aa21727f1404b3f479791

SHA1
6cbeaeda1b91434bc85c646211f6ba6c9f7f82ed

SHA256
6930b31674810296b1740e8a00d827011650ebd82099d6ad9a7428c5195bc70d

SHA512
2ce87e92e5b01ab3301e0b9f76d141ad9db1bacb1a8f5a8132ff31b0f91b997e84a78adcf4c2d6021c16c7dd7d6fd97a23fa8cb2da3b8a13a21b68975cab5658

Download Submit
/data/user/0/understanding.subsidy.questionnaire/app_DynamicOptDex/SNxnXY.json

Filesize
767KB

MD5
e05d87daa998d977061397a0140e9528

SHA1
e7510c986edf30a66f8f7091f82fb062007062a8

SHA256
72cb3743d4259011529a2727c31eb7fe791166fefaa44d6f8a2d40e5c093097e

SHA512
4077bc7ac1125b0ab8e035377188c5b3eb331502bc1f379fa604dd8b1fd9912569b28a55c9d6cb7ae2596ec68231c425b925cd4767a6f9c17d34effb013ba856

Download Submit

Analysis

Sharing