General

  • Target

    459e7ad6f07c0ee47495859317ca81fb55903d821f8f769a8bb4f97aecd3a79a

  • Size

    2.3MB

  • Sample

    220508-k1jxhsdee7

  • MD5

    ff0d447420e161800fb357f3a1339bab

  • SHA1

    3c204174bd1faa5e14796d0fc929d632c4dbf8c9

  • SHA256

    459e7ad6f07c0ee47495859317ca81fb55903d821f8f769a8bb4f97aecd3a79a

  • SHA512

    4a50face9298a587e8dbfe88af5b0057218e6fb121e026287f7f59bf2fafe1d9f1366063692e13e68dde04706a86ba8d3515645fe1b846b69d97fe159c6d7f6e

Malware Config

Extracted

Family

alienbot

C2

http://benibankagibisoy.xyz

Targets

    • Target

      459e7ad6f07c0ee47495859317ca81fb55903d821f8f769a8bb4f97aecd3a79a

    • Size

      2.3MB

    • MD5

      ff0d447420e161800fb357f3a1339bab

    • SHA1

      3c204174bd1faa5e14796d0fc929d632c4dbf8c9

    • SHA256

      459e7ad6f07c0ee47495859317ca81fb55903d821f8f769a8bb4f97aecd3a79a

    • SHA512

      4a50face9298a587e8dbfe88af5b0057218e6fb121e026287f7f59bf2fafe1d9f1366063692e13e68dde04706a86ba8d3515645fe1b846b69d97fe159c6d7f6e

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks