General

  • Target

    Porn_Tube.apk

  • Size

    2.9MB

  • Sample

    210810-g9y8blzna6

  • MD5

    5e8fbf5138cb86522cfc8891f637af8b

  • SHA1

    749412b843bfd62210b8ef47e5ee4527c7d97abe

  • SHA256

    3b4d55a0aaf3ea759e6aaf5229b7b87bd870ee37863d10b1d2f286c742e0add0

  • SHA512

    8f5de80e97da44be96755670717eac230904255c2e79c4c33f66d97c9262da5c13b3938478d24bc6f8f4190fde37441fcf59474489a64ea5cf889d47f9b05cb9

Malware Config

Extracted

Family

alienbot

C2

http://194.163.136.78

Targets

    • Target

      Porn_Tube.apk

    • Size

      2.9MB

    • MD5

      5e8fbf5138cb86522cfc8891f637af8b

    • SHA1

      749412b843bfd62210b8ef47e5ee4527c7d97abe

    • SHA256

      3b4d55a0aaf3ea759e6aaf5229b7b87bd870ee37863d10b1d2f286c742e0add0

    • SHA512

      8f5de80e97da44be96755670717eac230904255c2e79c4c33f66d97c9262da5c13b3938478d24bc6f8f4190fde37441fcf59474489a64ea5cf889d47f9b05cb9

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads name of network operator

      Uses Android APIs to discover system information.

MITRE ATT&CK Matrix

Tasks