General

  • Target

    58189275cb8f04c6347ad2036c22bd0cc1a1c973a384bb99a98fb86782a7acfb.apk

  • Size

    3.6MB

  • Sample

    220815-w6f9csecgj

  • MD5

    c2346156e936a054e9c2b792825c545f

  • SHA1

    02854f557537b2d9c0a2c7287df639008b034d87

  • SHA256

    58189275cb8f04c6347ad2036c22bd0cc1a1c973a384bb99a98fb86782a7acfb

  • SHA512

    27e5228d8367958f4d0e7f239375a614dede693562a389ab905f9bcfe4eb2b14ee1d37ecf627364c7c5920fd38b0b5406cf119157db9752bd2de59bb2de7cd4c

Malware Config

Extracted

Family

alienbot

C2

http://0lkoypi8ckkv9e.xyz

Targets

    • Target

      58189275cb8f04c6347ad2036c22bd0cc1a1c973a384bb99a98fb86782a7acfb.apk

    • Size

      3.6MB

    • MD5

      c2346156e936a054e9c2b792825c545f

    • SHA1

      02854f557537b2d9c0a2c7287df639008b034d87

    • SHA256

      58189275cb8f04c6347ad2036c22bd0cc1a1c973a384bb99a98fb86782a7acfb

    • SHA512

      27e5228d8367958f4d0e7f239375a614dede693562a389ab905f9bcfe4eb2b14ee1d37ecf627364c7c5920fd38b0b5406cf119157db9752bd2de59bb2de7cd4c

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks