alienbot | 8f408002a2c7305f6eff6b076043660b1fc29e7dc265a9fff0421a86081b987a

Analysis

max time kernel
136s
max time network
148s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
24-02-2024 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2112d3c6b589061b7c97fc2df9ee154.apk
Size

2.8MB
MD5

a2112d3c6b589061b7c97fc2df9ee154
SHA1

34e5b6a7785a08570a0aac4f12f64f8cff4d8274
SHA256

8f408002a2c7305f6eff6b076043660b1fc29e7dc265a9fff0421a86081b987a
SHA512

ed95d1ec68e4632816943595ba2a8ccb5452b9a654d3898155e02e3cb5d94f4ae115e6aa0ffc29284a5f4964623ec1c59c92cc20a77b77665faedb3e7060df1b
SSDEEP

49152:qLff3a3QVebJIOj+h3QsyGGf4Hel1QfaZCL2C9eIzQPC0T5KYH/Q5xKySEX:Wa3QV6tjwQ9bzAvRQa0T5DHI5EySEX

Score

10^/10

alienbot cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://194.163.136.78

rc4.plain

Extracted

Family

alienbot

http://194.163.136.78

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 1 IoCs

Processes:

resource	yara_rule
/data/data/involve.what.draw/app_DynamicOptDex/QPI.json	family_cerberus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

involve.what.draw

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	involve.what.draw
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	involve.what.draw

Removes its main activity from the application launcher 3 IoCs
stealth trojan

Processes:

involve.what.draw

pid process

5035 involve.what.draw
5035 involve.what.draw
5035 involve.what.draw

pid	process
5035	involve.what.draw
5035	involve.what.draw
5035	involve.what.draw

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

involve.what.draw

ioc	pid	process
/data/user/0/involve.what.draw/app_DynamicOptDex/QPI.json	5035	involve.what.draw
/data/user/0/involve.what.draw/app_DynamicOptDex/QPI.json	5035	involve.what.draw

Acquires the wake lock 1 IoCs

Processes:

involve.what.draw

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock involve.what.draw

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	involve.what.draw

involve.what.draw
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
PID:5035

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/involve.what.draw/app_DynamicOptDex/QPI.json

Filesize
659KB

MD5
6d1e85f28a94032f4636fa077efc9228

SHA1
5ecc78d09547f6ecb7dc3bbcf981c73364bdfcb1

SHA256
bf91bbf1ae0b91482f6815ea67447f68bd4d93a23ac36d7cb8e4c68bb086890c

SHA512
7810cc1875db0f214efeee80885ae197e3ec18974e680df6c4f306977664cbb4a505c1a5888c10c5be0747579d6028ca36078bca8c73c7fd25e636e81427be8c

Download Submit
/data/data/involve.what.draw/app_DynamicOptDex/QPI.json

Filesize
659KB

MD5
4c087c1b4143eb14c750c1d042ee298c

SHA1
f994f56d7d3cbe5533f9172a6bc6abbec2f8292b

SHA256
694ed4dce22a28358dd773c56472283c7dd20a26dfd0958e558a945690608103

SHA512
f1df38bfa45996411ab14f32a428fc84008af6e3ff4b0ac4aa26a041f5b681576360eec87520cee4534a5154c75b0cd9173c197c89fad1e6f69dfedf22f3e829

Download Submit
/data/data/involve.what.draw/app_DynamicOptDex/oat/QPI.json.cur.prof

Filesize
483B

MD5
ac91392e1439028d296856e1d21e09a5

SHA1
12a293ad9882096fe980df697d90e9a7ea586cea

SHA256
c6b4ad617545e731bebe6d7232c108bf453cb928c18b4807b04898e1ebecc489

SHA512
65b7557a0b8395c355bfb532e59282317539d1e1b3b1aa9a8bb3d6a73b74596f206c75ce556f24bd3c668c10c7779979da2b385924a4fa52ac163626cbe6320d

Download Submit