General

  • Target

    b47881184f891d42d56e4984c5558aa723aab4964e2a957666ec3c228615264a

  • Size

    1.2MB

  • Sample

    220508-kl956agccm

  • MD5

    356be1cca1949ec98bfe251504f70231

  • SHA1

    dd93307b1c11f1cbd94506e675d26273ce95e2fe

  • SHA256

    b47881184f891d42d56e4984c5558aa723aab4964e2a957666ec3c228615264a

  • SHA512

    45ff5c22ad9905541769b0873b33c104dabe9399fbeff4c9eda6e46f08bbdd7e0807dfb3656bd311fc8698dc460daa3566aedcf762b52d016192ad0dc91c1aab

Malware Config

Extracted

Family

alienbot

C2

http://odry.online

Targets

    • Target

      b47881184f891d42d56e4984c5558aa723aab4964e2a957666ec3c228615264a

    • Size

      1.2MB

    • MD5

      356be1cca1949ec98bfe251504f70231

    • SHA1

      dd93307b1c11f1cbd94506e675d26273ce95e2fe

    • SHA256

      b47881184f891d42d56e4984c5558aa723aab4964e2a957666ec3c228615264a

    • SHA512

      45ff5c22ad9905541769b0873b33c104dabe9399fbeff4c9eda6e46f08bbdd7e0807dfb3656bd311fc8698dc460daa3566aedcf762b52d016192ad0dc91c1aab

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks