General

  • Target

    YERLI_IFSA_GIZLI_CEKIM.apk

  • Size

    3.1MB

  • Sample

    210810-qbze4exnqs

  • MD5

    f27a16156566dd59fda402c3ce5d0928

  • SHA1

    16740f3e982c81da27a2594ffe716c0e89752d4a

  • SHA256

    b89349f430d4afe1900adcde123f11289abf2734588f5deaea856b46f503fce7

  • SHA512

    edb730d0126f9b8cf76491bb8f56bb709eb0b6cc78fd0786602a21ba6dca2be8028660f0eb6ba4f9b327b354135ea5960b324dccad3468d237dd1251288fb72b

Malware Config

Extracted

Family

alienbot

C2

http://95.156.227.194

Targets

    • Target

      YERLI_IFSA_GIZLI_CEKIM.apk

    • Size

      3.1MB

    • MD5

      f27a16156566dd59fda402c3ce5d0928

    • SHA1

      16740f3e982c81da27a2594ffe716c0e89752d4a

    • SHA256

      b89349f430d4afe1900adcde123f11289abf2734588f5deaea856b46f503fce7

    • SHA512

      edb730d0126f9b8cf76491bb8f56bb709eb0b6cc78fd0786602a21ba6dca2be8028660f0eb6ba4f9b327b354135ea5960b324dccad3468d237dd1251288fb72b

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads name of network operator

      Uses Android APIs to discover system information.

MITRE ATT&CK Matrix

Tasks