General

  • Target

    Porno_Izle.apk

  • Size

    2.9MB

  • Sample

    210810-ng3za48b1j

  • MD5

    35262b4f3d7b7c0dea8066ffeac03c99

  • SHA1

    cdc4b26c859979fc8283c1888f36584086cfcb99

  • SHA256

    2a0009f47d4f68c7812fab90522ec41db9fbf921fe3d239f92655412da07a975

  • SHA512

    1c71a31e5795cb649e99bf06de893537f18b7ae5f12886f538b1fd143979bd83d75e2fda6c25bcfec9322ef4e4930a4fb2612f1ad8296bf0e37245af332ea98d

Malware Config

Extracted

Family

alienbot

C2

http://194.163.136.78

Targets

    • Target

      Porno_Izle.apk

    • Size

      2.9MB

    • MD5

      35262b4f3d7b7c0dea8066ffeac03c99

    • SHA1

      cdc4b26c859979fc8283c1888f36584086cfcb99

    • SHA256

      2a0009f47d4f68c7812fab90522ec41db9fbf921fe3d239f92655412da07a975

    • SHA512

      1c71a31e5795cb649e99bf06de893537f18b7ae5f12886f538b1fd143979bd83d75e2fda6c25bcfec9322ef4e4930a4fb2612f1ad8296bf0e37245af332ea98d

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads name of network operator

      Uses Android APIs to discover system information.

MITRE ATT&CK Matrix

Tasks