General

  • Target

    6c6958eeef40ab7f3d03f254ad4af9fc76d126d38dc8fde5844c25ba8b03c119

  • Size

    2.9MB

  • Sample

    220605-rl5n1abag6

  • MD5

    051d10f100adda48b8eda53b16db9d3f

  • SHA1

    6f7382d524376e0e382bf98f570e7f491ca4c1b9

  • SHA256

    6c6958eeef40ab7f3d03f254ad4af9fc76d126d38dc8fde5844c25ba8b03c119

  • SHA512

    f7ff693876034db95d4a6f9d183e6745e89e626c525ebfdd0fbbf548e8fc3d68e9c2d92b8fe2b079c3857abb031cd6df290880e08854c071be3c2fda863ad595

Malware Config

Extracted

Family

alienbot

C2

http://kelime51421.com

Targets

    • Target

      6c6958eeef40ab7f3d03f254ad4af9fc76d126d38dc8fde5844c25ba8b03c119

    • Size

      2.9MB

    • MD5

      051d10f100adda48b8eda53b16db9d3f

    • SHA1

      6f7382d524376e0e382bf98f570e7f491ca4c1b9

    • SHA256

      6c6958eeef40ab7f3d03f254ad4af9fc76d126d38dc8fde5844c25ba8b03c119

    • SHA512

      f7ff693876034db95d4a6f9d183e6745e89e626c525ebfdd0fbbf548e8fc3d68e9c2d92b8fe2b079c3857abb031cd6df290880e08854c071be3c2fda863ad595

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks