alienbot

General

Target
98D85E9E46043780FC863A30D149505E377C82F2D668AFAE4FB4C647BF07A9AF.apk
Size 456KB
Sample240226-sycdnahe43
SHA256 98d85e9e46043780fc863a30d149505e377c82f2d668afae4fb4c647bf07a9af
MD5 b72c6108be79544049a01a1e35769f9d
SHA1 8e32645c945c37fe68d42dd439a65dc6efae8e5f
SHA512 383761c5584a25626c8ab5ece2c723110f32cae412fedb4f8036cbd82e13c23ea08e1f56adfc21ef845c1f38083fffb21ff614fc5ed05b5c77ea657925556d59
SSDEEP 6144:g1ieJKhn6YB7IfTLrQKV8EHCtxS5uxWet9zXRVGVF6XT3XXT3e1/D3DhcM8nD1AP:g0ngfrdks8ddGVYjHjo8DO7n88DO7nq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

alienbot

C2

http://kremmilk.xyz

Targets

- Target
  98D85E9E46043780FC863A30D149505E377C82F2D668AFAE4FB4C647BF07A9AF.apk
- Size 456KB
- SHA256 98d85e9e46043780fc863a30d149505e377c82f2d668afae4fb4c647bf07a9af
- MD5 b72c6108be79544049a01a1e35769f9d
- SHA1 8e32645c945c37fe68d42dd439a65dc6efae8e5f
- SHA512 383761c5584a25626c8ab5ece2c723110f32cae412fedb4f8036cbd82e13c23ea08e1f56adfc21ef845c1f38083fffb21ff614fc5ed05b5c77ea657925556d59
- SSDEEP 6144:g1ieJKhn6YB7IfTLrQKV8EHCtxS5uxWet9zXRVGVF6XT3XXT3e1/D3DhcM8nD1AP:g0ngfrdks8ddGVYjHjo8DO7n88DO7nq
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

alienbot cerberus banker collection evasion infostealer rat stealth trojan
- Alienbot
  Alienbot is a fork of Cerberus banker first seen in January 2020.
  banker trojan infostealer alienbot
- Cerberus
  An Android banker that is being rented to actors beginning in 2019.
  banker trojan infostealer evasion rat cerberus
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Removes its main activity from the application launcher
  stealth trojan
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Tasks

Sharing

General

Malware Config

Extracted

Targets

Cerberus

Makes use of the framework's Accessibility service

Removes its main activity from the application launcher

Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3