General

  • Target

    b5d89da7e293d672cf0f25a0dd6f648198fd87ec38d4c6e3dddbfd1ed476353d

  • Size

    1.8MB

  • Sample

    220521-d9v8kscahn

  • MD5

    901e5f8fad8eebb16b2fef94d374e28c

  • SHA1

    95ceb552c963f8f77dbc0141b263e1fff513b6ef

  • SHA256

    b5d89da7e293d672cf0f25a0dd6f648198fd87ec38d4c6e3dddbfd1ed476353d

  • SHA512

    3bce831f56d35a23f4fa6abf928413c0b3608661e3eba3e92db092b3c60b50d9509aa61754e89d07e2c0660b270d3ac67f324df1de5490da627e135bb4c954d0

Malware Config

Extracted

Family

alienbot

C2

http://akinbilisimv.org

Targets

    • Target

      b5d89da7e293d672cf0f25a0dd6f648198fd87ec38d4c6e3dddbfd1ed476353d

    • Size

      1.8MB

    • MD5

      901e5f8fad8eebb16b2fef94d374e28c

    • SHA1

      95ceb552c963f8f77dbc0141b263e1fff513b6ef

    • SHA256

      b5d89da7e293d672cf0f25a0dd6f648198fd87ec38d4c6e3dddbfd1ed476353d

    • SHA512

      3bce831f56d35a23f4fa6abf928413c0b3608661e3eba3e92db092b3c60b50d9509aa61754e89d07e2c0660b270d3ac67f324df1de5490da627e135bb4c954d0

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks