General

  • Target

    79b384ce704a6dc24f0af972cc24e12ed6f3a8f7ab3739d6279642435f399497

  • Size

    2.6MB

  • Sample

    220516-cd3r4shfc8

  • MD5

    75fe4067f1b0a3e7f30453575c47f254

  • SHA1

    cc8ec6ac3178050bc10b5e5c2dd62b344eafa88c

  • SHA256

    79b384ce704a6dc24f0af972cc24e12ed6f3a8f7ab3739d6279642435f399497

  • SHA512

    f02a2ddbc45cc8f855f3832fea8fd6ab2ec08c84f5ee446f0e3fcd26689db71c8793048d2c35b6896e373a24461d969e7c589347fac7886f24ed3ba856677214

Malware Config

Extracted

Family

alienbot

C2

http://manavgatselalesi2.xyz

Targets

    • Target

      79b384ce704a6dc24f0af972cc24e12ed6f3a8f7ab3739d6279642435f399497

    • Size

      2.6MB

    • MD5

      75fe4067f1b0a3e7f30453575c47f254

    • SHA1

      cc8ec6ac3178050bc10b5e5c2dd62b344eafa88c

    • SHA256

      79b384ce704a6dc24f0af972cc24e12ed6f3a8f7ab3739d6279642435f399497

    • SHA512

      f02a2ddbc45cc8f855f3832fea8fd6ab2ec08c84f5ee446f0e3fcd26689db71c8793048d2c35b6896e373a24461d969e7c589347fac7886f24ed3ba856677214

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks