General

  • Target

    2cf092c936471d14d3ee6718cd51b59a0ed4476786fa367c81e9e0f6c310e0b9.apk

  • Size

    1.8MB

  • Sample

    220121-n63hlahaa3

  • MD5

    5bb57271f13250023aabd63191de4879

  • SHA1

    5185cd06cc07e4719fa47760511263454e3e6201

  • SHA256

    2cf092c936471d14d3ee6718cd51b59a0ed4476786fa367c81e9e0f6c310e0b9

  • SHA512

    df9e3da08c8063d7783a980b76950c545c995b2eaeddbbbc24968316c95b4f577b78433ce67b6442daf8fa2ec1a18bf68b670783ca75d3a2dec0d8824c8ad1a3

Malware Config

Extracted

Family

alienbot

C2

http://yoklesfomerdesgomres.net

Targets

    • Target

      2cf092c936471d14d3ee6718cd51b59a0ed4476786fa367c81e9e0f6c310e0b9.apk

    • Size

      1.8MB

    • MD5

      5bb57271f13250023aabd63191de4879

    • SHA1

      5185cd06cc07e4719fa47760511263454e3e6201

    • SHA256

      2cf092c936471d14d3ee6718cd51b59a0ed4476786fa367c81e9e0f6c310e0b9

    • SHA512

      df9e3da08c8063d7783a980b76950c545c995b2eaeddbbbc24968316c95b4f577b78433ce67b6442daf8fa2ec1a18bf68b670783ca75d3a2dec0d8824c8ad1a3

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

MITRE ATT&CK Matrix

Tasks