General

  • Target

    2b2d0dd04e272ea821c114a8366efc7651c56a548af2d488d8616bb25682cb72

  • Size

    1.5MB

  • Sample

    220213-p3f1vscadm

  • MD5

    c4693822db3636a03cbfc607550b19ac

  • SHA1

    52c16ec013db6f2854123e6b21d5686ef453bfbd

  • SHA256

    2b2d0dd04e272ea821c114a8366efc7651c56a548af2d488d8616bb25682cb72

  • SHA512

    60506b38da5c1bb405e82b5450dda7fafb68397d232730a252698cfc2633d02288e101862d0e76ebef4cc3684327c273e9599adbeb74bcc98e48406847773f1a

Malware Config

Extracted

Family

alienbot

C2

http://darkwhitechoco.top

Targets

    • Target

      2b2d0dd04e272ea821c114a8366efc7651c56a548af2d488d8616bb25682cb72

    • Size

      1.5MB

    • MD5

      c4693822db3636a03cbfc607550b19ac

    • SHA1

      52c16ec013db6f2854123e6b21d5686ef453bfbd

    • SHA256

      2b2d0dd04e272ea821c114a8366efc7651c56a548af2d488d8616bb25682cb72

    • SHA512

      60506b38da5c1bb405e82b5450dda7fafb68397d232730a252698cfc2633d02288e101862d0e76ebef4cc3684327c273e9599adbeb74bcc98e48406847773f1a

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Checks Qemu related system properties.

      Checks for Android system properties related to Qemu for Emulator detection.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

MITRE ATT&CK Matrix

Tasks