General

  • Target

    29b9277536ece802af0540fc74d2b44a84ef35eae5c576960402cffce78d669e

  • Size

    1.5MB

  • Sample

    220521-d9p2kahae7

  • MD5

    02a556b2aff090a4a4ff08e44dd359eb

  • SHA1

    aa1fe8ab0c45688d0df3b789a33f1717b9cc6faa

  • SHA256

    29b9277536ece802af0540fc74d2b44a84ef35eae5c576960402cffce78d669e

  • SHA512

    3d216c379896b881eea94e8549d9b9916ce9e46e98e9fba03da718820fffdcbdfd40ad44a561b1ba99d4931958194cee584db80525cccca23245b39b6b1fb62f

Malware Config

Extracted

Family

alienbot

C2

http://operolstels12.site

Targets

    • Target

      29b9277536ece802af0540fc74d2b44a84ef35eae5c576960402cffce78d669e

    • Size

      1.5MB

    • MD5

      02a556b2aff090a4a4ff08e44dd359eb

    • SHA1

      aa1fe8ab0c45688d0df3b789a33f1717b9cc6faa

    • SHA256

      29b9277536ece802af0540fc74d2b44a84ef35eae5c576960402cffce78d669e

    • SHA512

      3d216c379896b881eea94e8549d9b9916ce9e46e98e9fba03da718820fffdcbdfd40ad44a561b1ba99d4931958194cee584db80525cccca23245b39b6b1fb62f

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks