General

  • Target

    f6f8556893eed8e97c92c7d7043a1cb4f14481d43e81c780fc197b3d0291b2a3

  • Size

    1.4MB

  • Sample

    220524-r8cazafbd8

  • MD5

    493f2107a91f649cbc0e2409e809aa42

  • SHA1

    c1502b9453a5b5a95f9f4357868bd8158913a682

  • SHA256

    f6f8556893eed8e97c92c7d7043a1cb4f14481d43e81c780fc197b3d0291b2a3

  • SHA512

    4fd29abced69840f3117873350df690eea4833fedc8161b18a1382bd06a838f7e920e4f0fa04a9c6e074f2dca9960bdaa90468d660de1fc06a35b69ee032a308

Malware Config

Extracted

Family

alienbot

C2

http://easy13.ru.com

Targets

    • Target

      f6f8556893eed8e97c92c7d7043a1cb4f14481d43e81c780fc197b3d0291b2a3

    • Size

      1.4MB

    • MD5

      493f2107a91f649cbc0e2409e809aa42

    • SHA1

      c1502b9453a5b5a95f9f4357868bd8158913a682

    • SHA256

      f6f8556893eed8e97c92c7d7043a1cb4f14481d43e81c780fc197b3d0291b2a3

    • SHA512

      4fd29abced69840f3117873350df690eea4833fedc8161b18a1382bd06a838f7e920e4f0fa04a9c6e074f2dca9960bdaa90468d660de1fc06a35b69ee032a308

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks