General

  • Target

    8e363a4e88cc7abc6ef6385970f35f6f4c0b56b9a081023c72a51cf248729c92

  • Size

    1.5MB

  • Sample

    220521-d9xfmscahq

  • MD5

    2c50fa7640659abfb258d8e9ec574412

  • SHA1

    6ffc1d4a019f0b1743c714aed7bc45db6e098344

  • SHA256

    8e363a4e88cc7abc6ef6385970f35f6f4c0b56b9a081023c72a51cf248729c92

  • SHA512

    d81250236c7afa70f9bb0b9def99cbf5bbb7a504dd2a5687d5ca7135e0556ba4b0da7b0f29100539204f3fd1cb77391336cf28b94678a29e682fab5c3c9c98db

Malware Config

Extracted

Family

alienbot

C2

http://kaatellech.xyz

Targets

    • Target

      8e363a4e88cc7abc6ef6385970f35f6f4c0b56b9a081023c72a51cf248729c92

    • Size

      1.5MB

    • MD5

      2c50fa7640659abfb258d8e9ec574412

    • SHA1

      6ffc1d4a019f0b1743c714aed7bc45db6e098344

    • SHA256

      8e363a4e88cc7abc6ef6385970f35f6f4c0b56b9a081023c72a51cf248729c92

    • SHA512

      d81250236c7afa70f9bb0b9def99cbf5bbb7a504dd2a5687d5ca7135e0556ba4b0da7b0f29100539204f3fd1cb77391336cf28b94678a29e682fab5c3c9c98db

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

MITRE ATT&CK Matrix

Tasks