alienbot

General

Target
36a4e5bde5cb0129fc2995ab3a6944891cdeb2645b5f8436c0d0a10839c54777.bin
Size 559KB
Sample250813-1192psxyhs
SHA256 36a4e5bde5cb0129fc2995ab3a6944891cdeb2645b5f8436c0d0a10839c54777
MD5 ca3ff8996d29380d28c25f3f694cac11
SHA1 be3fe46c464a02d2624640f88bd56f7eee12992e
SHA512 08df18e66531c8f1294edd4398abd12aedbd90d054b04cea10bda96bf236b033580c69f2594231f097fa7532c2bfd614cfdfc9e516840118f8be28fac109927a
SSDEEP 12288:RrrYWc4ai3cNf6jHKMe7odJlXQRmYIUn1D54J/NgYXdglXy:RXxcJWjG2JlXVYIKD4wYtglXy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

alienbot

C2

http://alcaroot.net/

Targets

- Target
  36a4e5bde5cb0129fc2995ab3a6944891cdeb2645b5f8436c0d0a10839c54777.bin
- Size 559KB
- SHA256 36a4e5bde5cb0129fc2995ab3a6944891cdeb2645b5f8436c0d0a10839c54777
- MD5 ca3ff8996d29380d28c25f3f694cac11
- SHA1 be3fe46c464a02d2624640f88bd56f7eee12992e
- SHA512 08df18e66531c8f1294edd4398abd12aedbd90d054b04cea10bda96bf236b033580c69f2594231f097fa7532c2bfd614cfdfc9e516840118f8be28fac109927a
- SSDEEP 12288:RrrYWc4ai3cNf6jHKMe7odJlXQRmYIUn1D54J/NgYXdglXy:RXxcJWjG2JlXVYIKD4wYtglXy
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

alienbot cerberus banker collection credential_access defense_evasion discovery evasion execution infostealer persistence rat stealth trojan
- Alienbot
  Alienbot is a fork of Cerberus banker first seen in January 2020.
  banker trojan infostealer alienbot
- Alienbot family
  alienbot
- Cerberus
  An Android banker that is being rented to actors beginning in 2019.
  banker trojan infostealer evasion rat cerberus
- Cerberus family
  cerberus
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral1 behavioral2 behavioral3