General

  • Target

    Porno_Izle.apk

  • Size

    3.2MB

  • Sample

    210820-lznpft8z4n

  • MD5

    03f03027f6d1f021e845b23cf3a15aea

  • SHA1

    76d1fe6ca6ef8bb7f03574c60ec5259c9dfd6bf6

  • SHA256

    7e914e4c0769a7a1dcf7d3a06160bfbd9f7b583695ccc9282854c2946b0321db

  • SHA512

    ba02a72c684203191cc5521d5405c7077739c16a82cb1e1f52dff3ad5bd85d7d62e3bbd156eca02ac81aa89c1ad3dd9167e8994adb0e3f51db3d55c71d0b0ca3

Malware Config

Extracted

Family

alienbot

C2

http://34.89.218.199

Targets

    • Target

      Porno_Izle.apk

    • Size

      3.2MB

    • MD5

      03f03027f6d1f021e845b23cf3a15aea

    • SHA1

      76d1fe6ca6ef8bb7f03574c60ec5259c9dfd6bf6

    • SHA256

      7e914e4c0769a7a1dcf7d3a06160bfbd9f7b583695ccc9282854c2946b0321db

    • SHA512

      ba02a72c684203191cc5521d5405c7077739c16a82cb1e1f52dff3ad5bd85d7d62e3bbd156eca02ac81aa89c1ad3dd9167e8994adb0e3f51db3d55c71d0b0ca3

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads name of network operator

      Uses Android APIs to discover system information.

MITRE ATT&CK Matrix

Tasks