General

  • Target

    d39190cff5304b6ecd0831d3d225f0d5565b947f2a982311c56ec31077539d3c

  • Size

    2.1MB

  • Sample

    220524-2aqqtaaaf7

  • MD5

    d428045a054412306f97ea7c0d5ebc66

  • SHA1

    87a4dcbc20d350645c6782c8b276ab9d71f9472b

  • SHA256

    d39190cff5304b6ecd0831d3d225f0d5565b947f2a982311c56ec31077539d3c

  • SHA512

    661d3d96be6df9e6b3785ae79298be75913ee6afa19362bd36a26d7b1d29b7806375513e9ea99990f0fc147fc97721fdec1d81ea195ef52d1ed9189d277248b0

Malware Config

Extracted

Family

alienbot

C2

http://ibramsuliman.xyz

Targets

    • Target

      d39190cff5304b6ecd0831d3d225f0d5565b947f2a982311c56ec31077539d3c

    • Size

      2.1MB

    • MD5

      d428045a054412306f97ea7c0d5ebc66

    • SHA1

      87a4dcbc20d350645c6782c8b276ab9d71f9472b

    • SHA256

      d39190cff5304b6ecd0831d3d225f0d5565b947f2a982311c56ec31077539d3c

    • SHA512

      661d3d96be6df9e6b3785ae79298be75913ee6afa19362bd36a26d7b1d29b7806375513e9ea99990f0fc147fc97721fdec1d81ea195ef52d1ed9189d277248b0

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks