General

  • Target

    8484C2866F4404EFAE683034430804680EC740B0919E435C3897EE45C3AE3759.apk

  • Size

    1.8MB

  • Sample

    220603-g9zsjsbgb4

  • MD5

    6f578eab62f3c76e7319284f6b199ed7

  • SHA1

    368f26efd03c9e9c3c2f07d3c84c414c2cf666b5

  • SHA256

    8484c2866f4404efae683034430804680ec740b0919e435c3897ee45c3ae3759

  • SHA512

    398144a369836788e78f36aa928809ffcd04a43ac7168373982c6c5d8cb5db2203982643d1ef32d76f3288cc9ec2f046ebc9dddf4aeb935d519c5ee1606295f6

Malware Config

Extracted

Family

alienbot

C2

http://cacecarsa2.com

Targets

    • Target

      8484C2866F4404EFAE683034430804680EC740B0919E435C3897EE45C3AE3759.apk

    • Size

      1.8MB

    • MD5

      6f578eab62f3c76e7319284f6b199ed7

    • SHA1

      368f26efd03c9e9c3c2f07d3c84c414c2cf666b5

    • SHA256

      8484c2866f4404efae683034430804680ec740b0919e435c3897ee45c3ae3759

    • SHA512

      398144a369836788e78f36aa928809ffcd04a43ac7168373982c6c5d8cb5db2203982643d1ef32d76f3288cc9ec2f046ebc9dddf4aeb935d519c5ee1606295f6

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks