General

  • Target

    9afb2fd955dcb5668148b0f9c311ff130c996dc549834bc9cfcab2d652fa9adc

  • Size

    1.9MB

  • Sample

    220524-3nhg2abhc5

  • MD5

    5cc2a048c2ae4db2f40b05c81d480ba5

  • SHA1

    1c94950ba4b204721f4da889d9b9035990d638f5

  • SHA256

    9afb2fd955dcb5668148b0f9c311ff130c996dc549834bc9cfcab2d652fa9adc

  • SHA512

    8d934d984d411fd3dc872e89fee358064d9bc44287bc7c8d9c24ae4b1433688d7e849ca2144e14af51344b75b9481c685a9bb79439f69fbe2b368105d4282377

Malware Config

Extracted

Family

alienbot

C2

http://cokomellatomalarko.top

Targets

    • Target

      9afb2fd955dcb5668148b0f9c311ff130c996dc549834bc9cfcab2d652fa9adc

    • Size

      1.9MB

    • MD5

      5cc2a048c2ae4db2f40b05c81d480ba5

    • SHA1

      1c94950ba4b204721f4da889d9b9035990d638f5

    • SHA256

      9afb2fd955dcb5668148b0f9c311ff130c996dc549834bc9cfcab2d652fa9adc

    • SHA512

      8d934d984d411fd3dc872e89fee358064d9bc44287bc7c8d9c24ae4b1433688d7e849ca2144e14af51344b75b9481c685a9bb79439f69fbe2b368105d4282377

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks