edevlet.apk

General
Target

edevlet.apk

Size

2MB

Sample

201212-5z6xptvwra

Score
10 /10
MD5

9ae42055cbeeea23fe962b2e51660c00

SHA1

bbcf2bdcca0c7d2326b71429c604e7447667f0c0

SHA256

c076650b8c03973f2f9f245a826cf0b7fa0d5add8182f33ec9b372d4b6796a04

SHA512

ff3d47a6871ce275d98350df870cb291d00963cd90c4d6cb94830206565fc8b99f7ef9c4a21b0f39d69d8a240d541d6cbb5906c1c2f63ea5a959687b4ba23829

Malware Config

Extracted

Family alienbot
C2

http://gunckerolu.xyz

Targets
Target

edevlet.apk

MD5

9ae42055cbeeea23fe962b2e51660c00

Filesize

2MB

Score
10 /10
SHA1

bbcf2bdcca0c7d2326b71429c604e7447667f0c0

SHA256

c076650b8c03973f2f9f245a826cf0b7fa0d5add8182f33ec9b372d4b6796a04

SHA512

ff3d47a6871ce275d98350df870cb291d00963cd90c4d6cb94830206565fc8b99f7ef9c4a21b0f39d69d8a240d541d6cbb5906c1c2f63ea5a959687b4ba23829

Tags

Signatures

  • Alienbot

    Description

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    Tags

  • Removes its main activity from the application launcher

  • Loads dropped Dex/Jar

    Description

    Runs executable file dropped to the device during analysis.

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks