General

  • Target

    5f51d30b1a28b2641482bf83a49479f46daa9047ee7cad024f0104636b15e2c2

  • Size

    2.5MB

  • Sample

    220208-cvk9dscbe5

  • MD5

    378740ef6e7c3fd8df21bb589e954c65

  • SHA1

    a001eb6e2ac229661a786a418adf00007490e56d

  • SHA256

    5f51d30b1a28b2641482bf83a49479f46daa9047ee7cad024f0104636b15e2c2

  • SHA512

    b7f6b847699bd11305491d33389e94b799b273f0c617705a6d6c560088aa4f1d8bb7f38ea0f96d1dc9f970d39eb14ec7d39d93ae2a33c99896fb9cdbb9071e4f

Malware Config

Extracted

Family

alienbot

C2

http://barmanka.xyz

Targets

    • Target

      5f51d30b1a28b2641482bf83a49479f46daa9047ee7cad024f0104636b15e2c2

    • Size

      2.5MB

    • MD5

      378740ef6e7c3fd8df21bb589e954c65

    • SHA1

      a001eb6e2ac229661a786a418adf00007490e56d

    • SHA256

      5f51d30b1a28b2641482bf83a49479f46daa9047ee7cad024f0104636b15e2c2

    • SHA512

      b7f6b847699bd11305491d33389e94b799b273f0c617705a6d6c560088aa4f1d8bb7f38ea0f96d1dc9f970d39eb14ec7d39d93ae2a33c99896fb9cdbb9071e4f

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

MITRE ATT&CK Matrix

Tasks