General

  • Target

    0258fc4cb74f7ed7f80b584df34583b309dff5d438c0e14c06dc1d3943d8ec80

  • Size

    1.5MB

  • Sample

    220523-z87qwaccbl

  • MD5

    0de236017a40cc9de91fe1072ac38cd0

  • SHA1

    06cbd0a6495fbce0acb01d7c1b1b28b95bf8bcb3

  • SHA256

    0258fc4cb74f7ed7f80b584df34583b309dff5d438c0e14c06dc1d3943d8ec80

  • SHA512

    ab77e7f31c3871c909aef2d0466a25d321f6a7098370e4348b7dd8196c940609a5fcbd5677a7d9ad8da6cae8a62e8bb47ae84419504d1a449c4eed73ce16de3c

Malware Config

Extracted

Family

alienbot

C2

http://odry.london

Targets

    • Target

      0258fc4cb74f7ed7f80b584df34583b309dff5d438c0e14c06dc1d3943d8ec80

    • Size

      1.5MB

    • MD5

      0de236017a40cc9de91fe1072ac38cd0

    • SHA1

      06cbd0a6495fbce0acb01d7c1b1b28b95bf8bcb3

    • SHA256

      0258fc4cb74f7ed7f80b584df34583b309dff5d438c0e14c06dc1d3943d8ec80

    • SHA512

      ab77e7f31c3871c909aef2d0466a25d321f6a7098370e4348b7dd8196c940609a5fcbd5677a7d9ad8da6cae8a62e8bb47ae84419504d1a449c4eed73ce16de3c

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks