General

  • Target

    3830acc79c670cf20e30034226d1916a57d2dffd15215ce067cae116badbcdfc

  • Size

    2.2MB

  • Sample

    220125-kaha1acba3

  • MD5

    619e6314d0bde9c2c516bb92c442c76f

  • SHA1

    9a0ab0b8b33d4a8874741cf84e7c67737c3206db

  • SHA256

    3830acc79c670cf20e30034226d1916a57d2dffd15215ce067cae116badbcdfc

  • SHA512

    e21d974bee2aba7222e9c1c0d385051a73e2f8c1d65cebb32a15ac7fc60c8f5df2c397017b2366683ecf68a004a500704aacb039ab79cf4e436cca1be1041e36

Malware Config

Extracted

Family

alienbot

C2

http://selamolsunselam.tk

Targets

    • Target

      3830acc79c670cf20e30034226d1916a57d2dffd15215ce067cae116badbcdfc

    • Size

      2.2MB

    • MD5

      619e6314d0bde9c2c516bb92c442c76f

    • SHA1

      9a0ab0b8b33d4a8874741cf84e7c67737c3206db

    • SHA256

      3830acc79c670cf20e30034226d1916a57d2dffd15215ce067cae116badbcdfc

    • SHA512

      e21d974bee2aba7222e9c1c0d385051a73e2f8c1d65cebb32a15ac7fc60c8f5df2c397017b2366683ecf68a004a500704aacb039ab79cf4e436cca1be1041e36

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

MITRE ATT&CK Matrix

Tasks