General

  • Target

    B6E38B5E6D52FF61E8D933A9D67CF0E25CC3C58D55C66EFDA186A5F896B45B67.apk

  • Size

    1.8MB

  • Sample

    220603-g7j93sfehm

  • MD5

    5c2ecef11891d1c63d4ca92fccb4e7c5

  • SHA1

    6b31aaca8276cb95de2892cdd580172c701533aa

  • SHA256

    b6e38b5e6d52ff61e8d933a9d67cf0e25cc3c58d55c66efda186a5f896b45b67

  • SHA512

    63984397f3e32bacd4e3bb46eab3e8e8a5a562be2e68e0e0179197d89c6c02abc714f929be02be2ee2789c17e0790e9221f46dcade5e88bc967446fd912fe0b1

Malware Config

Extracted

Family

alienbot

C2

http://malimaskim.xyz

Targets

    • Target

      B6E38B5E6D52FF61E8D933A9D67CF0E25CC3C58D55C66EFDA186A5F896B45B67.apk

    • Size

      1.8MB

    • MD5

      5c2ecef11891d1c63d4ca92fccb4e7c5

    • SHA1

      6b31aaca8276cb95de2892cdd580172c701533aa

    • SHA256

      b6e38b5e6d52ff61e8d933a9d67cf0e25cc3c58d55c66efda186a5f896b45b67

    • SHA512

      63984397f3e32bacd4e3bb46eab3e8e8a5a562be2e68e0e0179197d89c6c02abc714f929be02be2ee2789c17e0790e9221f46dcade5e88bc967446fd912fe0b1

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks