General

  • Target

    82f984f49b7133b9c5081b7e40fa89125867e6d3e1006fb30013089a463cfcec

  • Size

    2.1MB

  • Sample

    220525-br1n8secc7

  • MD5

    7cfae3ed58219833949f9d7e79b7b621

  • SHA1

    a0ee356a6a88b60bb7128cd2c7167caa45f5f890

  • SHA256

    82f984f49b7133b9c5081b7e40fa89125867e6d3e1006fb30013089a463cfcec

  • SHA512

    b30aea2132eb9bbb6f96680e14a75be7fabba883f5570ecbae113a92193e3cd1d2008a525551290f34ee15d621caa9f13c8e773e2b506cbce6be104239b363d0

Malware Config

Extracted

Family

alienbot

C2

http://hadigelgidelimm.top

Targets

    • Target

      82f984f49b7133b9c5081b7e40fa89125867e6d3e1006fb30013089a463cfcec

    • Size

      2.1MB

    • MD5

      7cfae3ed58219833949f9d7e79b7b621

    • SHA1

      a0ee356a6a88b60bb7128cd2c7167caa45f5f890

    • SHA256

      82f984f49b7133b9c5081b7e40fa89125867e6d3e1006fb30013089a463cfcec

    • SHA512

      b30aea2132eb9bbb6f96680e14a75be7fabba883f5570ecbae113a92193e3cd1d2008a525551290f34ee15d621caa9f13c8e773e2b506cbce6be104239b363d0

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks