alienbot

General

Target

4f577de33c5c535bb98338839793408b610ea39ab8c0226d579b86e2c68adaa7.zip
Size

1.8MB
Sample

250325-3zxq4avses
MD5

9c75778b8316ace4e5a5251db339d3ba
SHA1

648bf5d1bbb851de500d306205921ebe6a593d27
SHA256

4f577de33c5c535bb98338839793408b610ea39ab8c0226d579b86e2c68adaa7
SHA512

d8a92208b404de12490020539dd892a83686e453fcde951e65106094c01d46176470044afe65e1d24276f606bb49b5c9ebe02e388a91be0d77bb1397d9fb157c
SSDEEP

49152:JPwQw0RFXBfdFUWAt5c5DpwnSZviV+JCdLlxDkoIU5KTTmpcl:pHJUFt5c5D6SZNCdLvD6pTmpcl

Score

10^/10

Malware Config

Extracted

Family

alienbot

C2

http://ricktreemonkey54st.com

Targets

- Target
  
  b1cd0d501d8a0022d2ce360cb601f171d8938af613e13814e0af68e79a77c3a9.apk
- Size
  
  1.8MB
- MD5
  
  184f3e4e3577530c667d122f8ef7ed7f
- SHA1
  
  f98af84fbe8bf1f9cb4b94eaf730efdca920bbbb
- SHA256
  
  b1cd0d501d8a0022d2ce360cb601f171d8938af613e13814e0af68e79a77c3a9
- SHA512
  
  95a39582b06a77fc2036b7d864cbb51adaf809d19528454db2febedbea2bdbeda867a7cae7f4f47d7b081504449f18e3f4c9143821835fd1f74038501e9a580e
- SSDEEP
  
  49152:st8DZe8Qn/pzcRRFrzrfQhXFFTF+XP5J5boF3EGiNJ/D57hugVd:Res3+Z45J5kF3ziNxNd
Score

10^/10

alienbot cerberus banker collection credential_access defense_evasion discovery evasion execution infostealer persistence rat stealth trojan
- Alienbot
  Alienbot is a fork of Cerberus banker first seen in January 2020.
  banker trojan infostealer alienbot
- Alienbot family
  alienbot
- Cerberus
  An Android banker that is being rented to actors beginning in 2019.
  banker trojan infostealer evasion rat cerberus
- Cerberus family
  cerberus
- Cerberus payload
- Removes its main activity from the application launcher
  stealth trojan evasion
- Checks Android system properties for emulator presence.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral1 behavioral2 behavioral3