alienbot | 33528ee3961ad36c5bd460879e995a63a77edb02186d3bd5ba702c9091648715

General

Target
33528ee3961ad36c5bd460879e995a63a77edb02186d3bd5ba702c9091648715.apk
Size 2.8MB
Sample260813-cb4xdszbqd
SHA256 33528ee3961ad36c5bd460879e995a63a77edb02186d3bd5ba702c9091648715
MD5 932ea764a32fb2594c479264be1e095a
SHA1 b129a03b5b716f181dd4c52fdedcf6e78fa2f6fc
SHA512 ac40c40b81b8c9acb81bbe771a03adf9ee5e75f76e142606fc843087d505f9b2424736c512d484074f9fdc5d0040a2bbee18e6f19acfe9d7420f3c37a3180e41
SSDEEP 49152:QdHsoLPx3DXofiTVEBx4Il1JJYLi+2LYE3IG8nvq7iEftfGmqIq97mXry:QdMol7ofiTxIlOV3E3BKc9BGmHsy7y
TLSH
T1F9D533185BFD6DC1C80F55F4A34B1A62E556A2198232F5EBCAC8C294C93FEC48D76E34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  33528ee3961ad36c5bd460879e995a63a77edb02186d3bd5ba702c9091648715.apk
- Size 2.8MB
- SHA256 33528ee3961ad36c5bd460879e995a63a77edb02186d3bd5ba702c9091648715
- MD5 932ea764a32fb2594c479264be1e095a
- SHA1 b129a03b5b716f181dd4c52fdedcf6e78fa2f6fc
- SHA512 ac40c40b81b8c9acb81bbe771a03adf9ee5e75f76e142606fc843087d505f9b2424736c512d484074f9fdc5d0040a2bbee18e6f19acfe9d7420f3c37a3180e41
- SSDEEP 49152:QdHsoLPx3DXofiTVEBx4Il1JJYLi+2LYE3IG8nvq7iEftfGmqIq97mXry:QdMol7ofiTxIlOV3E3BKc9BGmHsy7y
- TLSH
  T1F9D533185BFD6DC1C80F55F4A34B1A62E556A2198232F5EBCAC8C294C93FEC48D76E34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution alienbot cerberus impact infostealer persistence rat trojan
- Cerberus payload
- Family: Alienbot
  Alienbot is a fork of Cerberus banker first seen in January 2020.
  banker trojan infostealer alienbot
- Family: Cerberus
  An Android banker that is being rented to actors beginning in 2019.
  banker trojan infostealer evasion rat cerberus
- Checks Android system properties for emulator presence.
  defense_evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral1