General

  • Target

    Android-Guncelleme.apk

  • Size

    2.6MB

  • Sample

    210810-tfg9c1zrkx

  • MD5

    1742936fc3118792758eaecef0991ea3

  • SHA1

    c939e399263a53f5e5e4563085e5ff85a7ab0352

  • SHA256

    057809e3b42b8b7a4f437a8cdbed5f7b78da66127794f8a9bf4f686693544be3

  • SHA512

    13fd7c45e0af19d37336bea774977ab074aecb285f24e7e95cb23bb0d4b460f1165ccd014d532f8c9a45842bd2779205834048eb06896b4b9819581090a30b7a

Malware Config

Extracted

Family

alienbot

C2

http://rareqtereqqer.sbs

Targets

    • Target

      Android-Guncelleme.apk

    • Size

      2.6MB

    • MD5

      1742936fc3118792758eaecef0991ea3

    • SHA1

      c939e399263a53f5e5e4563085e5ff85a7ab0352

    • SHA256

      057809e3b42b8b7a4f437a8cdbed5f7b78da66127794f8a9bf4f686693544be3

    • SHA512

      13fd7c45e0af19d37336bea774977ab074aecb285f24e7e95cb23bb0d4b460f1165ccd014d532f8c9a45842bd2779205834048eb06896b4b9819581090a30b7a

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads name of network operator

      Uses Android APIs to discover system information.

MITRE ATT&CK Matrix

Tasks