Overview

overview

10

Static

static

6

beb41073bb...96.apk

android-9-x86

10

beb41073bb...96.apk

android-11-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    134s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    23-02-2024 22:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    beb41073bb04429078a1dc2b781ac6c47da3f34cfec7347bfa7a27ca29f02496.apk

  • Size

    4.9MB

  • MD5

    983411f142d382b114bd2f3b3242dfca

  • SHA1

    5658da4cbf643263788bc35b1f6225b314e04559

  • SHA256

    beb41073bb04429078a1dc2b781ac6c47da3f34cfec7347bfa7a27ca29f02496

  • SHA512

    9714c36b4e472170be06a48b5ca7900d2fbbc81d7dc7480f710e1fce87cc6134ca41460dad737d633a3a33098ba4655438a3a50027fa6dd7a85c88e45e553b05

  • SSDEEP

    98304:f41xY6ILqyZKQwtuKJ2JLSJKrBZ/S/G98ISGn50XYd5brdx+jWjrTuaKKMOB95a:x6lyZ7y/2mwHopodR3Pjrqa3MOf5a

Score
10/10
alienbotbankercollectionevasioninfostealerstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://buuc5x0r7x98fj40mg2x.xyz

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 7 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • org.extraordinary.immigrant
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4265
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/org.extraordinary.immigrant/app_DynamicOptDex/irxuKb.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/org.extraordinary.immigrant/app_DynamicOptDex/oat/x86/irxuKb.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4292

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/org.extraordinary.immigrant/app_DynamicOptDex/irxuKb.json
    Filesize

    231KB

    MD5

    3514bf45d854930849b9b718112574b1

    SHA1

    a921cdf87db33aa5b6c0399b10e256a062f0152c

    SHA256

    6764d62f213a3fd4b7d10bcaf041f1856d54285f5f55b88be7d50a11f27e6d82

    SHA512

    1b6639facd10596066d8458d4f55382d2c90efa52f2fee5c1d266ae90e072ddcdfa65501cdf77c12d7a405d9bfa6f504d2c608d1303afdb0249f53d3a3040b53

    Download Submit

  • /data/data/org.extraordinary.immigrant/app_DynamicOptDex/oat/irxuKb.json.cur.prof
    Filesize

    1KB

    MD5

    d761350e9283faccb3f58c5450807065

    SHA1

    772d66eb702349b06c00b3b91a82ff3e0db2c2fc

    SHA256

    25118f930f2bb1512052a9525560a1d1648966cb89d83a03d57fc01320ad408e

    SHA512

    0631e045ae46f36f5fbac9b31efbbbcd9e7f887e02153b5ef9c68ee6d415bcbeb32c02cf7e9e7e712c5c268f5f166059c3e33307b1a166b575106e8ad1141782

    Download Submit

  • /data/user/0/org.extraordinary.immigrant/app_DynamicOptDex/irxuKb.json
    Filesize

    856KB

    MD5

    f2bf669ea506925bb3535020038b8fa5

    SHA1

    40e08db3bd4ae7a91a73ee71d2f49faba4ca51c7

    SHA256

    4a093cdef9440c10c168615b838bacf6e8e443bdc5cb0c4f8b7d90728495f31f

    SHA512

    5e6eaa476091b13fcf0651eefffeed03e241f9783ee6a12166dc44c3e0a223d944358b08024bd52d8baf80e55ef373bbb10a9c3f70cab70248460694e2c26c89

    Download Submit

  • /data/user/0/org.extraordinary.immigrant/app_DynamicOptDex/irxuKb.json
    Filesize

    912KB

    MD5

    2e058424d1caefdbcd0c82e4b9641076

    SHA1

    0f3a738c453d2b0673860893b608b0a455f0cd2f

    SHA256

    a736cc722cfc0cdb57331fd3af978b422879c755240ab7b18b9b867e5657c17e

    SHA512

    434f167a010229da13f2e5a74704614668d4a32c4aaf317d1415fa9c8d8ee998706fd83a7c9f8c3f2d2e3b3909e2b7c957f960659759850fc313971ac9ffc0c5

    Download Submit