General

  • Target

    d6ba9353f0557aafd8d64c2621c9fbd92aeadaf791a6ba1bde9451bb62e7bbfa

  • Size

    1.9MB

  • Sample

    220223-q4n9asbffn

  • MD5

    c05f39c01d0a631eb235c2dc1e2e3f7b

  • SHA1

    16b001deb9dac8d3e1620329bad18e22634580af

  • SHA256

    d6ba9353f0557aafd8d64c2621c9fbd92aeadaf791a6ba1bde9451bb62e7bbfa

  • SHA512

    123467466e7a009f94632a631073a389361ae92e4f845a05125815533c6108a5b8c37215e6c5d6d9cd82bd316cebe5a6429928761a599468d874b9e9b2ed6bb1

Malware Config

Extracted

Family

alienbot

C2

http://weatherforeveryday.site

Targets

    • Target

      d6ba9353f0557aafd8d64c2621c9fbd92aeadaf791a6ba1bde9451bb62e7bbfa

    • Size

      1.9MB

    • MD5

      c05f39c01d0a631eb235c2dc1e2e3f7b

    • SHA1

      16b001deb9dac8d3e1620329bad18e22634580af

    • SHA256

      d6ba9353f0557aafd8d64c2621c9fbd92aeadaf791a6ba1bde9451bb62e7bbfa

    • SHA512

      123467466e7a009f94632a631073a389361ae92e4f845a05125815533c6108a5b8c37215e6c5d6d9cd82bd316cebe5a6429928761a599468d874b9e9b2ed6bb1

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Checks Qemu related system properties.

      Checks for Android system properties related to Qemu for Emulator detection.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

MITRE ATT&CK Matrix

Tasks