alienbot | 8f408002a2c7305f6eff6b076043660b1fc29e7dc265a9fff0421a86081b987a

General

Target

a2112d3c6b589061b7c97fc2df9ee154.apk
Size

2.8MB
MD5

a2112d3c6b589061b7c97fc2df9ee154
SHA1

34e5b6a7785a08570a0aac4f12f64f8cff4d8274
SHA256

8f408002a2c7305f6eff6b076043660b1fc29e7dc265a9fff0421a86081b987a
SHA512

ed95d1ec68e4632816943595ba2a8ccb5452b9a654d3898155e02e3cb5d94f4ae115e6aa0ffc29284a5f4964623ec1c59c92cc20a77b77665faedb3e7060df1b
SSDEEP

49152:qLff3a3QVebJIOj+h3QsyGGf4Hel1QfaZCL2C9eIzQPC0T5KYH/Q5xKySEX:Wa3QV6tjwQ9bzAvRQa0T5DHI5EySEX

Score

10^/10

alienbot cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

C2

http://194.163.136.78

rc4.plain

Extracted

Family

alienbot

C2

http://194.163.136.78

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/involve.what.draw/app_DynamicOptDex/QPI.json	family_cerberus
/data/user/0/involve.what.draw/app_DynamicOptDex/QPI.json	family_cerberus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

involve.what.draw

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	involve.what.draw
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	involve.what.draw

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

involve.what.draw

pid process

4237 involve.what.draw
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
evasion

System Checks
T1633.001

Processes:

involve.what.draw

description ioc process

Accessed system property key: ro.product.model involve.what.draw

pid	process
4237	involve.what.draw

description	ioc	process
Accessed system property	key: ro.product.model	involve.what.draw

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

involve.what.draw/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/involve.what.draw/app_DynamicOptDex/QPI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/involve.what.draw/app_DynamicOptDex/oat/x86/QPI.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/involve.what.draw/app_DynamicOptDex/QPI.json	4237	involve.what.draw
/data/user/0/involve.what.draw/app_DynamicOptDex/QPI.json	4264	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/involve.what.draw/app_DynamicOptDex/QPI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/involve.what.draw/app_DynamicOptDex/oat/x86/QPI.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/involve.what.draw/app_DynamicOptDex/QPI.json	4237	involve.what.draw

Acquires the wake lock 1 IoCs

Processes:

involve.what.draw

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock involve.what.draw
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

involve.what.draw

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS involve.what.draw

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	involve.what.draw

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	involve.what.draw

involve.what.draw
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4237
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/involve.what.draw/app_DynamicOptDex/QPI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/involve.what.draw/app_DynamicOptDex/oat/x86/QPI.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4264

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/involve.what.draw/app_DynamicOptDex/QPI.json

Filesize
659KB

MD5
6d1e85f28a94032f4636fa077efc9228

SHA1
5ecc78d09547f6ecb7dc3bbcf981c73364bdfcb1

SHA256
bf91bbf1ae0b91482f6815ea67447f68bd4d93a23ac36d7cb8e4c68bb086890c

SHA512
7810cc1875db0f214efeee80885ae197e3ec18974e680df6c4f306977664cbb4a505c1a5888c10c5be0747579d6028ca36078bca8c73c7fd25e636e81427be8c

Download Submit
/data/data/involve.what.draw/app_DynamicOptDex/oat/QPI.json.cur.prof

Filesize
504B

MD5
1dd293feed4ca3fbeae6dbec82394e1e

SHA1
3701d5076fb3862d1bb87e1826da1fdfccab0a92

SHA256
6616e2ef308f99f5f40403bca54a9a73146126a9aad042faa7c173830206fd41

SHA512
73ca07b382fd93d18c85935774b799499ea1df110e8e66729f482b3528bf255be52e86e6b69db9538016ef4b3feb69e169cac978d0b24a69038e6c232969d0e0

Download Submit
/data/user/0/involve.what.draw/app_DynamicOptDex/QPI.json

Filesize
659KB

MD5
4c087c1b4143eb14c750c1d042ee298c

SHA1
f994f56d7d3cbe5533f9172a6bc6abbec2f8292b

SHA256
694ed4dce22a28358dd773c56472283c7dd20a26dfd0958e558a945690608103

SHA512
f1df38bfa45996411ab14f32a428fc84008af6e3ff4b0ac4aa26a041f5b681576360eec87520cee4534a5154c75b0cd9173c197c89fad1e6f69dfedf22f3e829

Download Submit
/data/user/0/involve.what.draw/app_DynamicOptDex/QPI.json

Filesize
659KB

MD5
8c6b2b80c67b714173e5319dceef5d1c

SHA1
4be267e35da92f5f8013864387fa46bc4a7120d3

SHA256
cb40d6f36ada89e93625d4483422ecad2a21328a576e326a45b9b8815963bd9e

SHA512
26c295c5c5b5accdb3f6ac94fb5dd93d7f783401bfb37bd7cc702278542b6a75ac732cdeea011883f28779251fd074ead7c837b70e1f7b3e45538ac5a6716992

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads