General

  • Target

    f2712d1ccadb309f2b482fd2f7118be4707423f8374dd9dfa56dcdda60819ad4

  • Size

    1.2MB

  • Sample

    220205-jy3q6shegj

  • MD5

    d0ee960194950078ba2ef14203557ccd

  • SHA1

    9fa0428cc7b57e9a6c5a110cd0e18a8e13790808

  • SHA256

    f2712d1ccadb309f2b482fd2f7118be4707423f8374dd9dfa56dcdda60819ad4

  • SHA512

    35c5b5155265bff2d03bd9cb4eb9ad365c23bc967dcafdd8f9b439738182908ad566098468ca0bb8442173d1ac7122624da07e110544a702715535c6a1b86451

Malware Config

Extracted

Family

alienbot

C2

http://xancc4fp.online

Targets

    • Target

      f2712d1ccadb309f2b482fd2f7118be4707423f8374dd9dfa56dcdda60819ad4

    • Size

      1.2MB

    • MD5

      d0ee960194950078ba2ef14203557ccd

    • SHA1

      9fa0428cc7b57e9a6c5a110cd0e18a8e13790808

    • SHA256

      f2712d1ccadb309f2b482fd2f7118be4707423f8374dd9dfa56dcdda60819ad4

    • SHA512

      35c5b5155265bff2d03bd9cb4eb9ad365c23bc967dcafdd8f9b439738182908ad566098468ca0bb8442173d1ac7122624da07e110544a702715535c6a1b86451

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

MITRE ATT&CK Matrix

Tasks