General

  • Target

    2e5146a6bff5821cff33c6865ee47612ebc717896db5b36c16e95da8af74fa32

  • Size

    1.6MB

  • Sample

    220524-21mf3sbaa6

  • MD5

    6565c0a99bd8d3ea41c0c1284c4b8ec2

  • SHA1

    a4bbfabb518cdacd5d4247875dd47ec0c1c7b666

  • SHA256

    2e5146a6bff5821cff33c6865ee47612ebc717896db5b36c16e95da8af74fa32

  • SHA512

    fce08ed9513faeb8e651fd13e1163361bd6d58b396a7fa79636baf48608c2406151cb326a8df282bfc0a66974bf14c2759522d6e461147334feb12329a25bb44

Malware Config

Extracted

Family

alienbot

C2

http://perlof.site

Targets

    • Target

      2e5146a6bff5821cff33c6865ee47612ebc717896db5b36c16e95da8af74fa32

    • Size

      1.6MB

    • MD5

      6565c0a99bd8d3ea41c0c1284c4b8ec2

    • SHA1

      a4bbfabb518cdacd5d4247875dd47ec0c1c7b666

    • SHA256

      2e5146a6bff5821cff33c6865ee47612ebc717896db5b36c16e95da8af74fa32

    • SHA512

      fce08ed9513faeb8e651fd13e1163361bd6d58b396a7fa79636baf48608c2406151cb326a8df282bfc0a66974bf14c2759522d6e461147334feb12329a25bb44

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks