General

  • Target

    cea4d343c84bfa963dc830ab6e567089f96c615a55c21994370e16e2d787e1dc

  • Size

    1.8MB

  • Sample

    220524-sxxcfabfdr

  • MD5

    95bc5358059a5fa399dd8444700f9795

  • SHA1

    404559862ef2f8b7d55bf32f44ec9036cd82f02b

  • SHA256

    cea4d343c84bfa963dc830ab6e567089f96c615a55c21994370e16e2d787e1dc

  • SHA512

    3e4b423da42705d3fefe68d93e870596d45cf61e39a9590011bdca1b00c2cc259416575f2b0397fc752ca5dadb2c5947fdcf562f7b846cb2696b95a3525f61c6

Malware Config

Extracted

Family

alienbot

C2

http://opsela1.com

Targets

    • Target

      cea4d343c84bfa963dc830ab6e567089f96c615a55c21994370e16e2d787e1dc

    • Size

      1.8MB

    • MD5

      95bc5358059a5fa399dd8444700f9795

    • SHA1

      404559862ef2f8b7d55bf32f44ec9036cd82f02b

    • SHA256

      cea4d343c84bfa963dc830ab6e567089f96c615a55c21994370e16e2d787e1dc

    • SHA512

      3e4b423da42705d3fefe68d93e870596d45cf61e39a9590011bdca1b00c2cc259416575f2b0397fc752ca5dadb2c5947fdcf562f7b846cb2696b95a3525f61c6

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks