alienbot | 0086bace2a2b6d9d922c97e9cd75f300f3e02ffe7f36007108bf0a2f1f39189f

Analysis

max time kernel
143s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
10-01-2025 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0086bace2a2b6d9d922c97e9cd75f300f3e02ffe7f36007108bf0a2f1f39189f.apk
Size

1.5MB
MD5

a76f6f92ed559e1803cf03742b377968
SHA1

7b4d2ab29a2d7a6acc8fc47856da4ed6b01f3b57
SHA256

0086bace2a2b6d9d922c97e9cd75f300f3e02ffe7f36007108bf0a2f1f39189f
SHA512

fa61811fa73f2592f4224c52694b2cade979eeafe3568df4e19ad1383498bcce12946110d83a09a16645d370d58805caee4f3a3c2aaf844144cd8ec4dabafb37
SSDEEP

24576:MSKFrKoWvygWDh7TrO1N/drdBIjNIf97VcdSLj+mv4nrBb8:MBGdg9uL/dk07idSLj+7Bb8

Score

10^/10

alienbot cerberus banker collection credential_access discovery evasion execution infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://45.12.253.155

rc4.plain

Extracted

Family

alienbot

http://45.12.253.155

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Alienbot family
alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Cerberus family
cerberus

Cerberus payload 2 IoCs

resource	yara_rule
behavioral1/memory/4366-0.dex	family_cerberus
behavioral1/memory/4340-0.dex	family_cerberus

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4340	com.field.garment

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.field.garment/app_DynamicOptDex/mJAI.json	4366	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.field.garment/app_DynamicOptDex/mJAI.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.field.garment/app_DynamicOptDex/oat/x86/mJAI.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.field.garment/app_DynamicOptDex/mJAI.json	4340	com.field.garment

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.field.garment
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.field.garment

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.field.garment

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.field.garment

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.field.garment

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.field.garment
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.field.garment

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.field.garment

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.field.garment

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.field.garment

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.field.garment

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.field.garment

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.field.garment

com.field.garment
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4340
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.field.garment/app_DynamicOptDex/mJAI.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.field.garment/app_DynamicOptDex/oat/x86/mJAI.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4366

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.field.garment/app_DynamicOptDex/mJAI.json

Filesize
238KB

MD5
015fe6d750580d6796ef6728239c2d77

SHA1
734d6dd2a2cdee31d6a6b311800a1861196f6e30

SHA256
6fb25641c1d67c6343f00d510f61c897494f5ad3482ece1a39cd9a80ec7faeee

SHA512
17e41259a7f8ade39040406f02005ce8385bc42769a4bd3c03dfbd167cd48776ce0a0f636596fe47c88562ef7e41873575ca3b34281b53e58133ef5940b021f0

Download Submit
/data/data/com.field.garment/app_DynamicOptDex/mJAI.json

Filesize
238KB

MD5
95d4ccf5a95e9c8173382f4aba3335bf

SHA1
45216107337949913f682dc5c0c8fe9c78f21067

SHA256
9dac189da26808be6fbeb61a6a08121ba84d41ce456064975bdc9c1ae924d8de

SHA512
fe025aced9aa496e1e9519d36bc920a2c5ddcceb8b021e98e6550b2931ec97df5dca3d5f02b251152d74a30c63a21e060cb105ee8ddc638939ae8e93cf45f97a

Download Submit
/data/data/com.field.garment/app_DynamicOptDex/oat/mJAI.json.cur.prof

Filesize
492B

MD5
1489fd66514f334126c6d65c3d2eb28b

SHA1
6f82beb2042bc152f4831e974cdebda5abdc6fd3

SHA256
4f8b50af6d5f4d12b521dbd7aa1f690da1b70055f1c8cb371579d4e6ee5e0f06

SHA512
99e2e4be96f45de733d2477e39ab2484f3e09684813cac8302938f6ed273d93971451d2eb680f5cd338b0d8eb7f6fb1ab1b0df3e4bdbeec10ae0f360751e4611

Download Submit
/data/user/0/com.field.garment/app_DynamicOptDex/mJAI.json

Filesize
483KB

MD5
6821fe23e0710a44774280453dfcc198

SHA1
86b076e257dacf1058c78242b68cb84bb3c61dc4

SHA256
3995f030cd9b0eab1c7e45852d7224e4430c5f8f420498c1bfe47b850b72bcd3

SHA512
da0ba4ecaf7f7ce4ac66911a189d1345c6d2796bf37a5b838e2ac730a26d9296edd0f5243a8083438a7788470b5d7cb5c36842ab14c004ddff85a188d6cecdb7

Download Submit
/data/user/0/com.field.garment/app_DynamicOptDex/mJAI.json

Filesize
483KB

MD5
663445c897669ee3a1230e4a583a5818

SHA1
afc2d9c6933fddfbc26581e9d9a55c483e4630f2

SHA256
056e476cb5708ecad8443ae414b346ab2ff0f99fa5052eed1cdffc3c0b84c865

SHA512
77c08af30c99747c355be56f37173dc59253e5a7c23ac9d90c1c7ceee9cabace7caf6b3cf4b645168e9fbe2ec8a1351577693b9c383af5591b7b54f52b0162f4

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads