alienbot | 59b0c482d02ef1211b936a329a99819f7c3c603808960b53eca558f293362c85

General

Target
c58cb2d542178830e7d1a52227116256.apk
Size 3.4MB
Sample240313-lpkkcaab71
SHA256 59b0c482d02ef1211b936a329a99819f7c3c603808960b53eca558f293362c85
MD5 c58cb2d542178830e7d1a52227116256
SHA1 741f00d6ea8150d2baa39f27ca74c867284f993b
SHA512 36461b81c8dbb3fd5e3ded0d948a58b0f61e96753d4525fa0ce7671bef62078aeb69a292ccbf65071394d7bbec3277a3cec257a892f253cc86558bcb1c6d5657
SSDEEP 98304:4BoZZDIoNryzla4dBh1TL4bXmB4lAKW+PMTb721:4BoLIoYlHdBh1TLCXmB4l1Wr+1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

alienbot cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

C2

http://34.141.27.218

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_cerberus
behavioral1/memory/4269-1.dex	family_cerberus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	glove.resist.bring
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	glove.resist.bring

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4269	glove.resist.bring

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/glove.resist.bring/app_DynamicOptDex/XSAyu.json	4269	glove.resist.bring
/data/user/0/glove.resist.bring/app_DynamicOptDex/XSAyu.json	4294	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/glove.resist.bring/app_DynamicOptDex/XSAyu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/glove.resist.bring/app_DynamicOptDex/oat/x86/XSAyu.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/glove.resist.bring/app_DynamicOptDex/XSAyu.json	4269	glove.resist.bring

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	glove.resist.bring

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	glove.resist.bring

glove.resist.bring
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4269
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/glove.resist.bring/app_DynamicOptDex/XSAyu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/glove.resist.bring/app_DynamicOptDex/oat/x86/XSAyu.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4294

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

Input Injection

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

XSAyu.json

Path /data/data/glove.resist.bring/app_DynamicOptDex/XSAyu.json
Size 708KB
SHA256 04af61af06f512f39157a4aa3a200d0cf83f5985639837fdf87abe18f4d38699
MD5 bea250ccba37ddcf3b0017e8731ce3a9
SHA1 bfd2e049b89dfb856ee8e7425ad8aa82409fd144
SHA512 85604f40c8b84b2123721648a849660e723d87fef26aa250e2d0ac35c433d912d48addc32e0aeed4c74e294780c43a84e5a19aaa7eceb30ab87a7261137d2848
SSDEEP 12288:fTi7k2e6oSX52Ea4nVfpC84L7UUcIH2YeQ2vPCM6MtLoHqIml57HTf27A/NVE4KP:fukDAs4hp4QUcIHadvPCM6MtLqdOF+7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

XSAyu.json

Path /data/data/glove.resist.bring/app_DynamicOptDex/XSAyu.json
Size 708KB
SHA256 2a4e4e568eb7eba81075ed151763466d6505a4cb9ee9e447f373eb1a40bc1bc7
MD5 cc0be1e0e8d8e477fcc17b3b0888953e
SHA1 79f8d1fbbcb54c34f3642289e9f10eeee696efbe
SHA512 2982a62c5949e72d4dabd143a1ed305f532811f4ff2cb78bf54a2e04c47c38164cb6183e92e8d01c2b7a416e5fb1b7749cd2be0be7dfa7c1b1a8bbe0756ab9ce
SSDEEP 12288:IGI6E9gLo2Ta6HEvFrQ3vqtXXnMYLJM/65IDzKKe+TAk:IGI6SoTKNW8XMM+3
MD5 SHA1 SHA512 SSDEEP

Submit Download

XSAyu.json.cur.prof

Path /data/data/glove.resist.bring/app_DynamicOptDex/oat/XSAyu.json.cur.prof
Size 485B
SHA256 090bb13dc8e1ac3054ae9a584184bebeb98f6def1af465701f439fdac0ead090
MD5 47b68ab3b097174aa08bc259c62c8a69
SHA1 89a181690204818ffdfc01cb4e4dc14779d453df
SHA512 0710bd9a9cb2408598a5e09d6f2172683a9285ba61f95cda5a0bdec249c3a74d2bb9109f62a5ea24d56766e3a802f9f15ae9afc32630876b4a1d9740a9d7e3d8
MD5 SHA1 SHA512

Submit Download

XSAyu.json

Path /data/user/0/glove.resist.bring/app_DynamicOptDex/XSAyu.json
Size 708KB
SHA256 fef7f83b50a0e96ed4f3260f54e8dabaac5790430a718e2ca035e297f6f2ccf0
MD5 c80ab914d8587d9c3acc31807e8359c7
SHA1 858e9e79cfe8cf4d05a2dad8e24d44c9980003d6
SHA512 f635e4e1f1c39d03b8782fdfc5f9712d1e383837711528ccdf8193e42cd8ec841dec798b95cc7fb1497fcaadc8d983ec3023233e28d3ad825600e938a57079b9
SSDEEP 12288:IGI6E9gLo2Ta6HEvFrQ3vqtXXnMoDbyVmIHVYEN+TAk:IGI6SoTKNW8XMX/c
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads