General

  • Target

    8222a65aa1afe3ec8cfd2cf2d881f5c2e32806985d581b61e3c46ae128ef9824

  • Size

    1.3MB

  • Sample

    220524-12e8qahfd2

  • MD5

    e8153c869f2922843040f31f08ad7c9f

  • SHA1

    f8bd31a3136b0c86df586a2644bd24ee317f7dec

  • SHA256

    8222a65aa1afe3ec8cfd2cf2d881f5c2e32806985d581b61e3c46ae128ef9824

  • SHA512

    a63eb9c4a14f85df2db6cc844fceac9f71f3af4c808c5749fe68b55b6615521f1bf5112f5878309a9f09e5a8e65abbe1f3cf7296602e79f154f923c192382bce

Malware Config

Extracted

Family

alienbot

C2

http://cantapol.com

Targets

    • Target

      8222a65aa1afe3ec8cfd2cf2d881f5c2e32806985d581b61e3c46ae128ef9824

    • Size

      1.3MB

    • MD5

      e8153c869f2922843040f31f08ad7c9f

    • SHA1

      f8bd31a3136b0c86df586a2644bd24ee317f7dec

    • SHA256

      8222a65aa1afe3ec8cfd2cf2d881f5c2e32806985d581b61e3c46ae128ef9824

    • SHA512

      a63eb9c4a14f85df2db6cc844fceac9f71f3af4c808c5749fe68b55b6615521f1bf5112f5878309a9f09e5a8e65abbe1f3cf7296602e79f154f923c192382bce

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks