alienbot | 8a3cb0110d45d71f335ae9c07afb38d9e4a57b46529ff045f8ec3de1e6926d0c

General

Target
0da75ac97f4ec8954a961c270bcbe75bd2671c65cf25db45540b70f1ff403e31.zip
Size 3.5MB
Sample260413-wt2pjadv6l
SHA256 8a3cb0110d45d71f335ae9c07afb38d9e4a57b46529ff045f8ec3de1e6926d0c
MD5 125cebbdbaf30dcb12d130a13da20529
SHA1 093013da9bd008240fdf314cd45a9dc80bf2f157
SHA512 9f8e2af8e977f44c238ef42128f45990f0923dc0059d3f397f322aea400895b6f0bbc063916646b219a43d2370abc1b5597b62f7c58a77f7f350fd5ce358e98c
SSDEEP 49152:kqQXFxqo8g842El7p8N7sBg6AXA8JX8mrfiNZkdvEtHJ7qe9X0Nw5iu5KTARFg:gFxa47p8N1Nw858mj+ZrtHJxyuUiFg
TLSH
T17306337369918CF0A8B1B48DEDD7818AC8102B5EA1C5796D4209E5370AB4F2DDCDCE7E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  0da75ac97f4ec8954a961c270bcbe75bd2671c65cf25db45540b70f1ff403e31
- Size 3.7MB
- SHA256 0da75ac97f4ec8954a961c270bcbe75bd2671c65cf25db45540b70f1ff403e31
- MD5 6cf5d6abcc04d1d37c85df5dc543ba0e
- SHA1 a6256e0aa101fc07319f19d6908f174ed8d14f5f
- SHA512 5d5f1d000d3ee111b01aa7df044357778c5701848a3672de6817c2cb3452843bc8408f7e31cca1f3321ced0c444f9e6425ca419ef03a397d5f12e4736d31d18a
- SSDEEP 98304:PkjRM+ktw5k9uh7a5KJZ96mJ8dDLwcH1alkNr:PARpaw59Ra5CuPw6J
- TLSH
  T1EF060108FFA49484C0226DB08585928B841B439EAEDDF0BF3F5994E87867C552647EFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution alienbot cerberus infostealer persistence rat trojan
- Cerberus payload
- Family: Alienbot
  Alienbot is a fork of Cerberus banker first seen in January 2020.
  banker trojan infostealer alienbot
- Family: Cerberus
  An Android banker that is being rented to actors beginning in 2019.
  banker trojan infostealer evasion rat cerberus
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral1