alienbot

General

Target

ea4960b84756fd82fe43cb2cffdbe464df6dd4d48aa10d1cefe38aa8ac6eb44d.apk
Size

1.7MB
Sample

240315-nvy12afd5z
MD5

69663d2b344d5872d0a3ccc6f8fa7cd9
SHA1

3455a39c90775beaf6690d1b27b983bac2303389
SHA256

ea4960b84756fd82fe43cb2cffdbe464df6dd4d48aa10d1cefe38aa8ac6eb44d
SHA512

d4eb5c6d7d9300572a638c60146a96b0f3eae271caef09eccb6b20bd94836f27d825a74f933991442cfac065ed270ca65be9a00bcb077a8ece8ce7fc2fcd0bbd
SSDEEP

24576:ApPSssmK3/OmSX5N5O0gA3Kw7RDnnZLCLd080T9lj8b1BzuGY3HHDzfOTboEJeHZ:AhSswjq5S0DKw7RDZG73BJuGA0J2cwZ

Score

10^/10

Malware Config

Extracted

Family

alienbot

C2

http://185.255.131.145

rc4.plain

Extracted

Family

alienbot

C2

http://185.255.131.145

Targets

- Target
  
  ea4960b84756fd82fe43cb2cffdbe464df6dd4d48aa10d1cefe38aa8ac6eb44d.apk
- Size
  
  1.7MB
- MD5
  
  69663d2b344d5872d0a3ccc6f8fa7cd9
- SHA1
  
  3455a39c90775beaf6690d1b27b983bac2303389
- SHA256
  
  ea4960b84756fd82fe43cb2cffdbe464df6dd4d48aa10d1cefe38aa8ac6eb44d
- SHA512
  
  d4eb5c6d7d9300572a638c60146a96b0f3eae271caef09eccb6b20bd94836f27d825a74f933991442cfac065ed270ca65be9a00bcb077a8ece8ce7fc2fcd0bbd
- SSDEEP
  
  24576:ApPSssmK3/OmSX5N5O0gA3Kw7RDnnZLCLd080T9lj8b1BzuGY3HHDzfOTboEJeHZ:AhSswjq5S0DKw7RDZG73BJuGA0J2cwZ
Score

10^/10

alienbot cerberus banker collection evasion infostealer rat stealth trojan
- Alienbot
  Alienbot is a fork of Cerberus banker first seen in January 2020.
  banker trojan infostealer alienbot
- Cerberus
  An Android banker that is being rented to actors beginning in 2019.
  banker trojan infostealer evasion rat cerberus
- Cerberus payload
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Checks Android system properties for emulator presence.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Cerberus

Cerberus payload

Makes use of the framework's Accessibility service

Removes its main activity from the application launcher

Checks Android system properties for emulator presence.

Loads dropped Dex/Jar

Requests enabling of the accessibility settings.

Acquires the wake lock

Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3