General

  • Target

    10d1e6ae601fa0a62ccd268fed6253c11f97535010b387e1ead28e68a6ed28d8

  • Size

    2.0MB

  • Sample

    220524-z9zrnacdgp

  • MD5

    44b41e39f0266d981958319faa235fce

  • SHA1

    d430c34d555a93f6dc2c074638436b99489202eb

  • SHA256

    10d1e6ae601fa0a62ccd268fed6253c11f97535010b387e1ead28e68a6ed28d8

  • SHA512

    4088088cee78246e6b1f2fa8afa2138773acfa17235e1fc35f3914b751dff050cd6a469dc405ee17c6334b0a40aefaae34fa0c6932748f129eebf3446008a780

Malware Config

Extracted

Family

alienbot

C2

http://seachkanamali.xyz

Targets

    • Target

      10d1e6ae601fa0a62ccd268fed6253c11f97535010b387e1ead28e68a6ed28d8

    • Size

      2.0MB

    • MD5

      44b41e39f0266d981958319faa235fce

    • SHA1

      d430c34d555a93f6dc2c074638436b99489202eb

    • SHA256

      10d1e6ae601fa0a62ccd268fed6253c11f97535010b387e1ead28e68a6ed28d8

    • SHA512

      4088088cee78246e6b1f2fa8afa2138773acfa17235e1fc35f3914b751dff050cd6a469dc405ee17c6334b0a40aefaae34fa0c6932748f129eebf3446008a780

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks