General

  • Target

    Bildirim_Cubugu.apk

  • Size

    3.2MB

  • Sample

    210824-vkpwn3dn7x

  • MD5

    52abe8e7b491c4674f924c7c116e0998

  • SHA1

    790ac6997c1b9042e157e4dd2f314d5077155ecc

  • SHA256

    90ddf3acf9053e3d61ce3a125bd4998c71e75621567040cd31d3d27e76d3876f

  • SHA512

    d16fc4e8d3a53129babcab8ac128820089060f39825487e840af199c62f9b763e71aeacdec5389ad0520cbf36ff6e8388e5f7c299354fbcf6ab421527cfd6226

Malware Config

Extracted

Family

alienbot

C2

http://34.89.218.199

Targets

    • Target

      Bildirim_Cubugu.apk

    • Size

      3.2MB

    • MD5

      52abe8e7b491c4674f924c7c116e0998

    • SHA1

      790ac6997c1b9042e157e4dd2f314d5077155ecc

    • SHA256

      90ddf3acf9053e3d61ce3a125bd4998c71e75621567040cd31d3d27e76d3876f

    • SHA512

      d16fc4e8d3a53129babcab8ac128820089060f39825487e840af199c62f9b763e71aeacdec5389ad0520cbf36ff6e8388e5f7c299354fbcf6ab421527cfd6226

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads name of network operator

      Uses Android APIs to discover system information.

MITRE ATT&CK Matrix

Tasks