General

  • Target

    0033beddc60129f7bc4758568ab26f23b87c2c9443579c7f2121ba8aa584735a

  • Size

    1.9MB

  • Sample

    220524-3rxfcscac8

  • MD5

    635a3b4c3fecf1523f58be1b8fdce60b

  • SHA1

    eb5fbd2410a5cffb54bcd6274e9cfe35b306f6f9

  • SHA256

    0033beddc60129f7bc4758568ab26f23b87c2c9443579c7f2121ba8aa584735a

  • SHA512

    dbe5377509c337c31b46cfddf487244a03d59464bab0f5fa06531afff949103ba8da9fa898fbf55d3919ea48a7c791c106b232ad99245523c94f7c121860100b

Malware Config

Extracted

Family

alienbot

C2

http://odryreo.site

Targets

    • Target

      0033beddc60129f7bc4758568ab26f23b87c2c9443579c7f2121ba8aa584735a

    • Size

      1.9MB

    • MD5

      635a3b4c3fecf1523f58be1b8fdce60b

    • SHA1

      eb5fbd2410a5cffb54bcd6274e9cfe35b306f6f9

    • SHA256

      0033beddc60129f7bc4758568ab26f23b87c2c9443579c7f2121ba8aa584735a

    • SHA512

      dbe5377509c337c31b46cfddf487244a03d59464bab0f5fa06531afff949103ba8da9fa898fbf55d3919ea48a7c791c106b232ad99245523c94f7c121860100b

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks