Resubmissions

12-07-2023 09:39

230712-lmqctacf88 10

12-07-2023 09:31

230712-lhds8adf9x 10

General

  • Target

    com.CredemMobile.apk

  • Size

    1.8MB

  • Sample

    230712-lmqctacf88

  • MD5

    72a4c5ae2e38026b0007f6e3fba9824e

  • SHA1

    71bfb36941a37a4cb4b5d501f63c654f240f9176

  • SHA256

    61a589469a443a6997304da392a258cd5ddd2068f53b25e0b01d9ec86d651f17

  • SHA512

    b34552a4abb685de7a833ae538bf2a0e0adb067ac603cfde64ef0acb0130b4bc7219e52ba1abdc1e99f8d1623c8222ff4f9dbd6cf03496998a34b18f1d9c11c5

  • SSDEEP

    49152:DjI+HhliB/qCYfdfQyxFFTF+3M9tqjCMlm6jBbBg:1HniB/qCODZjtq958

Malware Config

Extracted

Family

alienbot

C2

http://soofoodoo.club

rc4.plain

Targets

    • Target

      com.CredemMobile.apk

    • Size

      1.8MB

    • MD5

      72a4c5ae2e38026b0007f6e3fba9824e

    • SHA1

      71bfb36941a37a4cb4b5d501f63c654f240f9176

    • SHA256

      61a589469a443a6997304da392a258cd5ddd2068f53b25e0b01d9ec86d651f17

    • SHA512

      b34552a4abb685de7a833ae538bf2a0e0adb067ac603cfde64ef0acb0130b4bc7219e52ba1abdc1e99f8d1623c8222ff4f9dbd6cf03496998a34b18f1d9c11c5

    • SSDEEP

      49152:DjI+HhliB/qCYfdfQyxFFTF+3M9tqjCMlm6jBbBg:1HniB/qCODZjtq958

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • Cerberus payload

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

MITRE ATT&CK Matrix

Tasks