General

  • Target

    Porno_Izle.apk

  • Size

    3.2MB

  • Sample

    210823-tzrwnjwb2n

  • MD5

    15b4ef12a281c43662138a9bb37d9456

  • SHA1

    1a9fbb759957025602457517995baf73ab615142

  • SHA256

    b77decb8c8407f3081f009624795035f912dd842224acb55b437dde937a338e6

  • SHA512

    a6750924d92ac92073bff32346d1cf5ba9a3908786fc73f4bbddd16c131abe2cbca05d53d9d14c69389e0e2822d542e324c3aaf6ab507d94b626aed7f768b3e4

Malware Config

Extracted

Family

alienbot

C2

http://34.89.218.199

Targets

    • Target

      Porno_Izle.apk

    • Size

      3.2MB

    • MD5

      15b4ef12a281c43662138a9bb37d9456

    • SHA1

      1a9fbb759957025602457517995baf73ab615142

    • SHA256

      b77decb8c8407f3081f009624795035f912dd842224acb55b437dde937a338e6

    • SHA512

      a6750924d92ac92073bff32346d1cf5ba9a3908786fc73f4bbddd16c131abe2cbca05d53d9d14c69389e0e2822d542e324c3aaf6ab507d94b626aed7f768b3e4

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads name of network operator

      Uses Android APIs to discover system information.

MITRE ATT&CK Matrix

Tasks