General

  • Target

    a11ec71c53dadc6d60452151a495c998ed01ae6720961ff574ddd67106b215fe

  • Size

    1.9MB

  • Sample

    220524-tz1y3sheg6

  • MD5

    9bfad241f185c8272b956b4a9d51d095

  • SHA1

    4e29c2077315fe9dbc2f8557f7234cdd9a218358

  • SHA256

    a11ec71c53dadc6d60452151a495c998ed01ae6720961ff574ddd67106b215fe

  • SHA512

    a5dfdf69d8a534335874dc716f66dc20004562e7bc5b91687691e589bd034bce73279ecd6251a9ea6a6ec762d2876ef16bcbd1dc334a44e7bb64634eed9531e5

Malware Config

Extracted

Family

alienbot

C2

http://dashatrevelergod.xyz

Targets

    • Target

      a11ec71c53dadc6d60452151a495c998ed01ae6720961ff574ddd67106b215fe

    • Size

      1.9MB

    • MD5

      9bfad241f185c8272b956b4a9d51d095

    • SHA1

      4e29c2077315fe9dbc2f8557f7234cdd9a218358

    • SHA256

      a11ec71c53dadc6d60452151a495c998ed01ae6720961ff574ddd67106b215fe

    • SHA512

      a5dfdf69d8a534335874dc716f66dc20004562e7bc5b91687691e589bd034bce73279ecd6251a9ea6a6ec762d2876ef16bcbd1dc334a44e7bb64634eed9531e5

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks