General

  • Target

    F4B2370E793CBC37ADD4081E1804C81CEB1EE9318D696BF32C7295585C8D86D5.apk

  • Size

    1.8MB

  • Sample

    220603-g8mrlaffcq

  • MD5

    e80a143554654a797bc631ba92e96f0a

  • SHA1

    655f83f51c484cf281a065232b1e9bbe121a727e

  • SHA256

    f4b2370e793cbc37add4081e1804c81ceb1ee9318d696bf32c7295585c8d86d5

  • SHA512

    5366fe997a515c4ef4cec730e040a81d5e4b3d053b72e6dd41f3ce208098a62128f03a253d70bb6a26ff1383fff58b2856d0d2d3dab8d01d7ef7e52e1c79510e

Malware Config

Extracted

Family

alienbot

C2

http://waluelines.com

Targets

    • Target

      F4B2370E793CBC37ADD4081E1804C81CEB1EE9318D696BF32C7295585C8D86D5.apk

    • Size

      1.8MB

    • MD5

      e80a143554654a797bc631ba92e96f0a

    • SHA1

      655f83f51c484cf281a065232b1e9bbe121a727e

    • SHA256

      f4b2370e793cbc37add4081e1804c81ceb1ee9318d696bf32c7295585c8d86d5

    • SHA512

      5366fe997a515c4ef4cec730e040a81d5e4b3d053b72e6dd41f3ce208098a62128f03a253d70bb6a26ff1383fff58b2856d0d2d3dab8d01d7ef7e52e1c79510e

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks