alienbot | 617ec2c8e213b27bee59716033fe62074986872d31c30376dceb7e737e3533f6

General

Target
d780257e0bb666be027137b631af1c12.apk
Size 2.9MB
Sample240320-a7bjlsda4s
SHA256 617ec2c8e213b27bee59716033fe62074986872d31c30376dceb7e737e3533f6
MD5 d780257e0bb666be027137b631af1c12
SHA1 44935c16e5e66978b8950f81f3a3b2273edc6daa
SHA512 449b59b57f1543f72a9e7a4e04ed6e755ca5a8f0e4d87a74dda9a0149b22cce59286b16b7c8da325817adedf0e6fc7c65e8d219cb00e626ed5e4913d7b799324
SSDEEP 49152:tRCnMKa2mz3yutQroZRydxCUuHLZeNvuDTYqVL2EWFriBm0ELjTIRtw:tYnfdBoZQd7ACGvlVLuFWIpjTIRG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

alienbot cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

alienbot

C2

http://

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_cerberus
behavioral1/memory/4465-1.dex	family_cerberus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	celery.roast.lawn
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	celery.roast.lawn

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4465	celery.roast.lawn

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/celery.roast.lawn/app_DynamicOptDex/NoT.json	4465	celery.roast.lawn
/data/user/0/celery.roast.lawn/app_DynamicOptDex/NoT.json	4492	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/celery.roast.lawn/app_DynamicOptDex/NoT.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/celery.roast.lawn/app_DynamicOptDex/oat/x86/NoT.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/celery.roast.lawn/app_DynamicOptDex/NoT.json	4465	celery.roast.lawn

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	celery.roast.lawn

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	celery.roast.lawn

celery.roast.lawn
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4465
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/celery.roast.lawn/app_DynamicOptDex/NoT.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/celery.roast.lawn/app_DynamicOptDex/oat/x86/NoT.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4492

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

Input Injection

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

NoT.json

Path /data/data/celery.roast.lawn/app_DynamicOptDex/NoT.json
Size 653KB
SHA256 b8228ec2ce0101f67710a73cb627a9a91c287626fd014f5aad787f7d8cdd0aa0
MD5 fd1c11559069001113f00baf3b81717b
SHA1 6834680054e2ee069be932b5eec33c469519f93a
SHA512 5db6210662f3cfcd7f3a129de9089c9cd9e86478ec557d48eae4eae8d6ff7f830cc2813199336be9edc3c09f9e2c003b85d5674bbd6a4443a5378abfea03160c
SSDEEP 12288:jG9uPJ8SDE7z/x4wbLPzdJqLXFeYwT5xM2rrWx8cQCdP28OEbR9OPV6NA06OjaN:oyRmFzLPzPmXFTdWEdkY203jE
MD5 SHA1 SHA512 SSDEEP

Submit Download

NoT.json

Path /data/data/celery.roast.lawn/app_DynamicOptDex/NoT.json
Size 653KB
SHA256 cd7bf34bc3afc3e969f844ba7bd3a4b1ee259c6c748e9e3777efb4cd9996b91c
MD5 142b5cd973e8a5b0d4201c58f9918c1e
SHA1 5c91a1f3ed47a4d725213e7cf81ee5438a9766a3
SHA512 7ea4ea6cd28b6c4805ae338f2bf7f35899a8ffabf1564a5612b615600bc41ed1a8c2866365c32f58d07fd2b9a2b2538610654bace271c666a2f4044a7c1c122a
SSDEEP 12288:3XSTKVrE9gLo9Mh6HEvH8bSKldXnOqmuf/O5BFglA1jZMBzkoP:3iOVenM5P8bSKld3EuXODnYd
MD5 SHA1 SHA512 SSDEEP

Submit Download

NoT.json

Path /data/user/0/celery.roast.lawn/app_DynamicOptDex/NoT.json
Size 399KB
SHA256 be7e628dfa95fe295bf6fa060f65284ba09cc8deb404349e928f1a6dbff7c2a3
MD5 dab9df7eeeb39bb355dec1a07d5dc5f8
SHA1 af90e78acfbefde7f782dc794995df4d097eb4ca
SHA512 279b50f25821da0480e32865616b41b4627fc0f70fac92710631b684ed438d051943cf7ec74343b2a7ea91be399731aa3e8e94bb3fb54360eaf0cfaf31b55dd6
SSDEEP 12288:3XSTKVrE9gLo9Mh6HEvH8bSKldXnOqmuf/O5/:3iOVenM5P8bSKld3EuXOV
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads