General

  • Target

    fe0498f516cc9946f94d9e50ccbf0a9347cf3e5d97a9d7e9f3b2f3cf9ea6b61d

  • Size

    2.6MB

  • Sample

    220508-he1l2ahfd4

  • MD5

    b275484a89980f299a245b93f21e1a3d

  • SHA1

    b4219642cdfe7cae29f1edab80585732509671a0

  • SHA256

    fe0498f516cc9946f94d9e50ccbf0a9347cf3e5d97a9d7e9f3b2f3cf9ea6b61d

  • SHA512

    80902cb35901941a5d0aaa514dd7b6a5b264f396265ef91eed02d82c6db0392b437ca77b7d929f676f38ebbc95ddb14815e6d6fb63020cd2d26142a7f9c2c7e8

Malware Config

Extracted

Family

alienbot

C2

http://fijora.top/

Targets

    • Target

      fe0498f516cc9946f94d9e50ccbf0a9347cf3e5d97a9d7e9f3b2f3cf9ea6b61d

    • Size

      2.6MB

    • MD5

      b275484a89980f299a245b93f21e1a3d

    • SHA1

      b4219642cdfe7cae29f1edab80585732509671a0

    • SHA256

      fe0498f516cc9946f94d9e50ccbf0a9347cf3e5d97a9d7e9f3b2f3cf9ea6b61d

    • SHA512

      80902cb35901941a5d0aaa514dd7b6a5b264f396265ef91eed02d82c6db0392b437ca77b7d929f676f38ebbc95ddb14815e6d6fb63020cd2d26142a7f9c2c7e8

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks