alienbot | 8d4ba01befd0bb33459d7232c376cfb036c68857433ecc05a3f127b8edd64a66

Analysis

max time kernel
146s
max time network
131s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
26/02/2024, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a55df1afefc9562dca22c6befa00003b.apk
Size 2.6MB
Sample240226-ehpgdscg2y
SHA256 8d4ba01befd0bb33459d7232c376cfb036c68857433ecc05a3f127b8edd64a66
MD5 a55df1afefc9562dca22c6befa00003b
SHA1 50616944bb194cb4f82dc28cd53c9dd4ca6f66f4
SHA512 38e2c410c5ac6b1dc2d91c1fddec77dd9a374c0f6e090dc460c1819a78d7693846264982eccab90c0b6e73d874e916c3022c813d05c1fa7542f3ddaa45948833
SSDEEP 49152:QwaTYBSLms8ge13jrI4c17HiFdnyx4I/+Usf6r4+rRf3VKnZNe9:zaTBiamIbmy6I/+U8wLt3UZc9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

alienbot cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://buralarneler.com

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 3 IoCs

resource	yara_rule
behavioral2/files/fstream-2.dat	family_cerberus
behavioral2/memory/5120-0.dex	family_cerberus
behavioral2/memory/5120-1.dex	family_cerberus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	sketch.arrange.wagon
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	sketch.arrange.wagon

Removes its main activity from the application launcher 5 IoCs

stealth trojan

pid	Process
5120	sketch.arrange.wagon
5120	sketch.arrange.wagon
5120	sketch.arrange.wagon
5120	sketch.arrange.wagon
5120	sketch.arrange.wagon

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/sketch.arrange.wagon/app_DynamicOptDex/tElQ.json	5120	sketch.arrange.wagon
/data/user/0/sketch.arrange.wagon/app_DynamicOptDex/tElQ.json	5120	sketch.arrange.wagon

sketch.arrange.wagon
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
PID:5120

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

tElQ.json.cur.prof

Path /data/data/sketch.arrange.wagon/app_DynamicOptDex/oat/tElQ.json.cur.prof
Size 384B
SHA256 096cdff49337a024ccfad671f31752226c1590203f6d8f2dbedbd74b4aa2fe50
MD5 1413282e171b01aa034f1ddfa4a8b917
SHA1 4693cd412307bf87842aad27a571c497bf115970
SHA512 eacbb014c4ac25d0c8cf53ffda1018402fa05cfa3aac7eee4fae28224fe18ecf6e945098189d24f279cf11c54d4901d6472becc2c3e614de5ebb24b5c7108e7e
MD5 SHA1 SHA512

Submit Download

tElQ.json

Path /data/data/sketch.arrange.wagon/app_DynamicOptDex/tElQ.json
Size 732KB
SHA256 3efaccb2cba254ed20a5644e5929252d61be1f172cf04f531d11721214c81863
MD5 7d6265aefe05d8a8c3e4cee8c85c66a3
SHA1 42ee9332f80d4ac52382e9e7e273bb06e0abc6d3
SHA512 b827b9d6a3322f6c73dea80d64283f49f016f65267ca9e57a1195e73ef660699ef81303ebff29e6b8ddc65c8131e228927fdee95158a0fa1c340b9d7b1aafca2
SSDEEP 12288:apEp5ErbbINPi3v2LekRTmjeqeFfdhuGDzZ+FNuWl3qHWMzidKQN6WRih3Q10l4m:Dp5YF2LieqeVdhp+ErYKMbiNcTARBf
MD5 SHA1 SHA512 SSDEEP

Submit Download

tElQ.json

Path /data/data/sketch.arrange.wagon/app_DynamicOptDex/tElQ.json
Size 501KB
SHA256 1f11803e4d5902bce41945bef8824f2c59711df55e76eb1ca2aa2bd0f1700219
MD5 fef5ae4c5004ed9e79ec947c87639d9f
SHA1 4198cbdd569698fa40faff702a1951ebfca1d5d1
SHA512 594395feb6ade71dcddce88083ce6d6b5aa824d5f57a5a2713bce0d83eb7c8215173a8084a8b2dd21fb9e15d1371db7dcae2002fab2253a4860020967caf1a86
SSDEEP 12288:4N1+1r9gLowRa6HEvFiVOSu6dPHosuHy7o:4N1+LcKN9SuqPHoR
MD5 SHA1 SHA512 SSDEEP

Submit Download

tElQ.json

Path /data/user/0/sketch.arrange.wagon/app_DynamicOptDex/tElQ.json
Size 421KB
SHA256 35d83782bffc24bc201f8cd077ffc78ddad5bea89e557fcce36b2ff76fe9677d
MD5 dd313d1a3c7f4bb554f0dc574d12ddfb
SHA1 cdceceb2db4d4eacdf17b730d00574c4c761a031
SHA512 5d2dc714bbad0293090192a9e78b4e5e528f451d29311e53699ec736c7c472374070277b32b70ddba0b832ea2d3918e886b1ad0ce82f9f5e8720850c0c0570fc
SSDEEP 6144:f9AOuN1+1vjtZzCkg2HOhnavlY/takA76H4pvFdZGVOujSJfS1LLP6it:4N1+1r9gLowRa6HEvFiVOSu6dPHt
MD5 SHA1 SHA512 SSDEEP

Download

tElQ.json

Path /data/user/0/sketch.arrange.wagon/app_DynamicOptDex/tElQ.json
Size 94KB
SHA256 38f4d5102961032426174704047dbd5a9be6d063e3ae12c3ffbbc42bbb3e5a2d
MD5 7a3d2a89018d3dc42c4de3850772b3b1
SHA1 df5391f918568f02bf507eea3ad18cc0d0a81281
SHA512 126a8ba9f074fe91ddc62a2908d6e635c5f574f74811ab04912aab982288639f4c44b052ce9276ed11ceed8c208998f4fc934ec6313eeb1470d8bd93bce20ecd
SSDEEP 1536:MHXIY9of4+qyW7OytNnKqfy/LCllN5OnxlFOOIDXHYZv:M3IYUAOuNdys+1OOgoZv
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads