General

  • Target

    TURK_IFSA_VIDEOLARI.apk

  • Size

    3.3MB

  • Sample

    210821-mgwp3l7xd2

  • MD5

    d8d350a851b553a6b02a952a0307b7eb

  • SHA1

    8c3485192bb7bbaf00ba942097067de1696d7a97

  • SHA256

    f7a2065371c494fe901131fc41ecd11895f34f0ebf7bb41512b0972c92784dbe

  • SHA512

    19b9d46ac9aab48c002c5853a6b13e8f427edd7cda492fe5834d6704b3d72368a09354e9c6b9212d2221556bde76d465d5f088f8bfff4b1164979413afbb8eb7

Malware Config

Extracted

Family

alienbot

C2

https://instagrambuyukprofil.com

Targets

    • Target

      TURK_IFSA_VIDEOLARI.apk

    • Size

      3.3MB

    • MD5

      d8d350a851b553a6b02a952a0307b7eb

    • SHA1

      8c3485192bb7bbaf00ba942097067de1696d7a97

    • SHA256

      f7a2065371c494fe901131fc41ecd11895f34f0ebf7bb41512b0972c92784dbe

    • SHA512

      19b9d46ac9aab48c002c5853a6b13e8f427edd7cda492fe5834d6704b3d72368a09354e9c6b9212d2221556bde76d465d5f088f8bfff4b1164979413afbb8eb7

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads name of network operator

      Uses Android APIs to discover system information.

MITRE ATT&CK Matrix

Tasks