General

  • Target

    d17ca7475491a45d8230b8e95deb4b9bf6a296845fb423f6366dbc3ab3ba40f4

  • Size

    2.4MB

  • Sample

    220508-ncrt1aggf5

  • MD5

    b8fed58ce0a7b54aae1b9b7f694afec8

  • SHA1

    c203163bbf019587425d07e59955e3facc0d8b21

  • SHA256

    d17ca7475491a45d8230b8e95deb4b9bf6a296845fb423f6366dbc3ab3ba40f4

  • SHA512

    f1b4a04a64823908224f54517e1b9fcc559150505183d159861b81a8087c61717a77516426325921c7865b75c03e05b7a994872162fa825939e771ea5dcb30c6

Malware Config

Extracted

Family

alienbot

C2

http://hkslesa1.com

Targets

    • Target

      d17ca7475491a45d8230b8e95deb4b9bf6a296845fb423f6366dbc3ab3ba40f4

    • Size

      2.4MB

    • MD5

      b8fed58ce0a7b54aae1b9b7f694afec8

    • SHA1

      c203163bbf019587425d07e59955e3facc0d8b21

    • SHA256

      d17ca7475491a45d8230b8e95deb4b9bf6a296845fb423f6366dbc3ab3ba40f4

    • SHA512

      f1b4a04a64823908224f54517e1b9fcc559150505183d159861b81a8087c61717a77516426325921c7865b75c03e05b7a994872162fa825939e771ea5dcb30c6

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks