General

  • Target

    41c116b17277f318484d46c3c04fcb0d9d6eef33e9149b5c85765e96e5186abb

  • Size

    2.1MB

  • Sample

    220524-18rv4ahhh6

  • MD5

    2fee475cedd49de458299e569b56c16a

  • SHA1

    0ff679464234fc2b2583de99e5051f16a3799f46

  • SHA256

    41c116b17277f318484d46c3c04fcb0d9d6eef33e9149b5c85765e96e5186abb

  • SHA512

    8c9e313e77997c06c41c0fc1d0ec68e6b95e26c1499f72be5c904943cf9a0a26297a856dc834bbec5e66711ff978965ac47fbd064797e8c95a91ec2273fd1b49

Malware Config

Extracted

Family

alienbot

C2

http://densizinhakkindanimansiz.top

Targets

    • Target

      41c116b17277f318484d46c3c04fcb0d9d6eef33e9149b5c85765e96e5186abb

    • Size

      2.1MB

    • MD5

      2fee475cedd49de458299e569b56c16a

    • SHA1

      0ff679464234fc2b2583de99e5051f16a3799f46

    • SHA256

      41c116b17277f318484d46c3c04fcb0d9d6eef33e9149b5c85765e96e5186abb

    • SHA512

      8c9e313e77997c06c41c0fc1d0ec68e6b95e26c1499f72be5c904943cf9a0a26297a856dc834bbec5e66711ff978965ac47fbd064797e8c95a91ec2273fd1b49

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks