General

  • Target

    381f3b60752d7eca83d02a1ab3df703969027468f9ddb3d7d0e99d671ef7c73e

  • Size

    2.2MB

  • Sample

    220520-gz4nrageen

  • MD5

    3adc3ddfcadfa1856df1e0d8f966856f

  • SHA1

    5e821fcf4ba791f694589955b1dbade857be4ac0

  • SHA256

    381f3b60752d7eca83d02a1ab3df703969027468f9ddb3d7d0e99d671ef7c73e

  • SHA512

    fa827cf3a5907790621680ea18fb56d793e22923f18d84cf3097e1aaaae5ecf2624ecac156a7f3409cc3570fe96c277ecdb559ff48ae7676b20b178e98d0965e

Malware Config

Extracted

Family

alienbot

C2

http://malimaskim.xyz

Targets

    • Target

      381f3b60752d7eca83d02a1ab3df703969027468f9ddb3d7d0e99d671ef7c73e

    • Size

      2.2MB

    • MD5

      3adc3ddfcadfa1856df1e0d8f966856f

    • SHA1

      5e821fcf4ba791f694589955b1dbade857be4ac0

    • SHA256

      381f3b60752d7eca83d02a1ab3df703969027468f9ddb3d7d0e99d671ef7c73e

    • SHA512

      fa827cf3a5907790621680ea18fb56d793e22923f18d84cf3097e1aaaae5ecf2624ecac156a7f3409cc3570fe96c277ecdb559ff48ae7676b20b178e98d0965e

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks