General

  • Target

    604b3cd50ef3b0df46bcb07a1d2d0fad31f517f4ef541036d9f0161d3c69499b

  • Size

    1.4MB

  • Sample

    220201-gxrleahhbp

  • MD5

    965250dc9f6afd4b419091813d4fd585

  • SHA1

    9c58d32eaa79c85644f9a50c56f8cacadb09e8b4

  • SHA256

    604b3cd50ef3b0df46bcb07a1d2d0fad31f517f4ef541036d9f0161d3c69499b

  • SHA512

    430129ba9e6b4ea919fbadc996b12a6a0e3b05786904688e7e5597789c880a86b67642cf35bccf65b75875ce6c9f4db1ec6c04b2143574964298a528a035edd4

Malware Config

Extracted

Family

alienbot

C2

http://ahf4ycvea439tt9rq.site

Targets

    • Target

      604b3cd50ef3b0df46bcb07a1d2d0fad31f517f4ef541036d9f0161d3c69499b

    • Size

      1.4MB

    • MD5

      965250dc9f6afd4b419091813d4fd585

    • SHA1

      9c58d32eaa79c85644f9a50c56f8cacadb09e8b4

    • SHA256

      604b3cd50ef3b0df46bcb07a1d2d0fad31f517f4ef541036d9f0161d3c69499b

    • SHA512

      430129ba9e6b4ea919fbadc996b12a6a0e3b05786904688e7e5597789c880a86b67642cf35bccf65b75875ce6c9f4db1ec6c04b2143574964298a528a035edd4

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

MITRE ATT&CK Matrix

Tasks