General

  • Target

    d1daa8dcbbe3cdbe4ff97598d8b93c7c2562229c5c081f35068d6a66a8591035.bin

  • Size

    1.4MB

  • Sample

    230815-1w26asdf94

  • MD5

    37d5b4132abf222c1f020a518a73a038

  • SHA1

    ffa2978b4f32635a80038a39f36dec0db92e7f5d

  • SHA256

    d1daa8dcbbe3cdbe4ff97598d8b93c7c2562229c5c081f35068d6a66a8591035

  • SHA512

    0b10138f5a2f380272b374d2c4f6d4666ad2903e94441148be99c650995945bba17718b37cdd90b4ecf1489e707456e07af55439cd10863f937b16c420c63ca3

  • SSDEEP

    24576:7uz3zr+ViQEjbwQ2PlVtjOpw/POdTTWk86ROHwJADDOsT24htss7ZxBsasnSJzhq:7uPr+SbwQ6xjOpw/y3WYRSwJ89T2mssO

Malware Config

Extracted

Family

alienbot

C2

http://yamac230cc.xyz

rc4.plain

Targets

    • Target

      d1daa8dcbbe3cdbe4ff97598d8b93c7c2562229c5c081f35068d6a66a8591035.bin

    • Size

      1.4MB

    • MD5

      37d5b4132abf222c1f020a518a73a038

    • SHA1

      ffa2978b4f32635a80038a39f36dec0db92e7f5d

    • SHA256

      d1daa8dcbbe3cdbe4ff97598d8b93c7c2562229c5c081f35068d6a66a8591035

    • SHA512

      0b10138f5a2f380272b374d2c4f6d4666ad2903e94441148be99c650995945bba17718b37cdd90b4ecf1489e707456e07af55439cd10863f937b16c420c63ca3

    • SSDEEP

      24576:7uz3zr+ViQEjbwQ2PlVtjOpw/POdTTWk86ROHwJADDOsT24htss7ZxBsasnSJzhq:7uPr+SbwQ6xjOpw/y3WYRSwJ89T2mssO

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • Cerberus payload

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

    • Target

      EularsB_sub.svg

    • Size

      1008B

    • MD5

      cba3b620bb98ca1080aef02845e79acc

    • SHA1

      3d9fd1bd824b7dccb4e49290d090b8ca8fa46c28

    • SHA256

      4ca10b296fce75746fc2663d69b35159b37b954dec65dc9cf660028e02b0cb60

    • SHA512

      cf9cb799403b44a52cbeecb012d1ad9818240a8efa5543d15dfd18eada49abed8265d8681f5f5a3456f5d7f358dfc6b831309af0ac7159dfa4a0da278ae8183f

    Score
    3/10
    • Target

      Factorial_sub.svg

    • Size

      701B

    • MD5

      42b28d156719df282309756a34c0a5bd

    • SHA1

      c1ba8f4a5be9a80da380901b4a377bfcbcc7b9fb

    • SHA256

      4ff932dab9bfc11b6547349bf0687eba5c093852ec21e41c4e7fc8815ee8f348

    • SHA512

      f0b11389dd20aef4e9d291b60ee5501eefbe1f62da4b66ae49104733e70e0bb3ed97fb676982e908f3bd9d1b450e0d222ce7e856270ef1171aaaab399c1c8962

    Score
    3/10
    • Target

      Fraction_sub.svg

    • Size

      494B

    • MD5

      d4a949fdf52952cc148069a5ab1cda09

    • SHA1

      9bc68bfe31966146161e4f1d3904fe2837f9f1f4

    • SHA256

      b25ebc2a6abee5348d57ad2252e356b421315d3134c4269b13a221320cc4f4eb

    • SHA512

      d43e6e1cbd47d3a75cfe821b2cd6836f4e000f482567cea9f97ec5f949fcc690610d3b9f59c5acabbf5ed222658faba0e604fe5859de6a94faece50e2b1845b8

    Score
    3/10
    • Target

      GreaterThanOr_sub.svg

    • Size

      529B

    • MD5

      183ab03927d5d94c808d6ab0e8bd5d72

    • SHA1

      94695a1ad1d71e412778c65f610834a2e87d3a64

    • SHA256

      b3c2197cf9ab0a352d9ff3cf5657f06a6e26ad815e7a783bea4e1e17ba2babf0

    • SHA512

      66cd9167775c9879ce3c5f0cc63fdab37d5f059a8b2c4b42de1725e5356b3aa682b7845b2d06f4d1e573173591f830d24c41095fce80f2da8d52d924ac495741

    Score
    3/10
    • Target

      Imaginary_num_sub.svg

    • Size

      1KB

    • MD5

      b5e148b7d33d9357d420de007309c502

    • SHA1

      5b592e54ece60b5d6e0cc247251009f822bf7296

    • SHA256

      8dcd63ab0e395866e15c4ec8c50d0dac49d8118fb8463a8b9bfd1667b4895afe

    • SHA512

      a9434577373ae46ff632f3254f56e6804911b26d7902392e81802a83207d762dce85c64e973de4d7c72c7cc14dbbbac6f628a1473ddc50ac44409069549697e2

    Score
    3/10
    • Target

      LessThanOr_sub.svg

    • Size

      532B

    • MD5

      ffc78a6304742e04f2879c4a11f3d369

    • SHA1

      d1547c090e070bcc7c19666ad9a0112316e43137

    • SHA256

      69ffca2fd95c8119d9c0cdab62bccf24f7799e03e4d84ffe7736e10d0611b808

    • SHA512

      18d196273b7923cb09c211d460f1aec6669ddd5cc8eabd3d747579ad5e540bd19cd15e26da6cf726ad4539ff5629f6dc3c2e84bb104d7d0df3aaa7579fed4dcd

    Score
    3/10
    • Target

      Ln_sub.svg

    • Size

      906B

    • MD5

      50948f090a36b025ceeadb20cfedf70c

    • SHA1

      5d1222847e797a649d2a1115f09522004388cb5c

    • SHA256

      fe98593b9944c672753c1e1404bf2d8edba24474c189d4c229bbb94219259565

    • SHA512

      a6deec560f44944b6e2ce14254edb23f127fd413873e68f7ab3c238653ae7395ec44f96dab61ba75a2e8eb841693b10c86b7ba9829d97890140958edef5f8272

    Score
    3/10
    • Target

      Log_Base_sub.svg

    • Size

      1KB

    • MD5

      92c38ebf2823cbb4f85ebc00130d483f

    • SHA1

      9365238a540f63b0949e9ba3214376057db9fb84

    • SHA256

      afe3aa2fa70f0649b11d8e7880995036e00fc53dfc54d6afe2013fc4af5449d3

    • SHA512

      7a1cf10c2b75a957ada24088ed4d21e7e3d59eef7c2c3c4cd78551c54ee054862c161a0b581bded7bfab758e7c149d2c1164210da687aa625e64842b1c7f979e

    Score
    3/10
    • Target

      MixedFraction_sub.svg

    • Size

      553B

    • MD5

      e1b8068a20f4030c991f37f6dcb89071

    • SHA1

      f0f55451231bd9ce797f8d4f819c45b5b84ea540

    • SHA256

      056b91a230f814a0f5ee461b1a78ecc37088656beda49db42b572f5e329a3e3f

    • SHA512

      bc2474c6c9da3b580be3a13aa2bede1ad3ea929ee599a9b04e171aaae0d2df0e8f17ee3bcae4dd27bdd508b526a4fcd3c4673e7accb57efe1dd569b8d6157b2b

    Score
    3/10
    • Target

      NthRoot_sub.svg

    • Size

      657B

    • MD5

      a0df17f1518f2fb86e7344246a2e4e69

    • SHA1

      47191ae14807686f0bc12469d44f8c2dc9a68457

    • SHA256

      a2fa04cf6fb2057bb09c6269bca6392e2e38d140fe4536c381d7d539b1521b3a

    • SHA512

      867e10feda5358e0adb6280a5dd552e441b38755e5991f84601feac114d7ad1a53273d066af313595614f49aefa925ad6f0d2123664f36b3a965488c853f21ed

    Score
    3/10
    • Target

      PI_sub.svg

    • Size

      923B

    • MD5

      6ce587a0e5450f657616880bf2a8c20a

    • SHA1

      fada1d7082f216acb7a94ed9bf76442ad4e3b557

    • SHA256

      60128e9d8298ba321d66c0a391d9f1d9f4e07f10e902b925aaee7ad652956a00

    • SHA512

      3aba47621fab9bb79822ec430aaa5d2c338bccdbbc2caf1ccd11df66947e889fd24af788099c7b8c4674803102348f9c32f8e13dca28d6dfd5ea8e6c754ebe28

    Score
    3/10
    • Target

      Sub3_sub.svg

    • Size

      996B

    • MD5

      052b26be64b95a1ebb88a6562d1e288c

    • SHA1

      acff78075b9816cc27056bad2289ac8f3856cfe0

    • SHA256

      8e8b2ee62ac6abe6377a3dd688bbbe0b2280fe3833cf45e38872a2e276c181c6

    • SHA512

      4453b4e5b350a91ef011ce7906f32f560a5787d37bd380a32156a56a23752983cc56727ad900c6ce5829cc5d9934bfc8ca78f8cd7fde32a47e77b80c5a11e6ec

    Score
    3/10
    • Target

      Super3_sub.svg

    • Size

      1KB

    • MD5

      0afb1f3ae2e3817d6637de5096725941

    • SHA1

      6851415d1500b345d9630eb19225501d196e5a02

    • SHA256

      364f4c4f75e4ea55a354e502491107b19e0d3cdaff1f277474550bfb8b192250

    • SHA512

      3c0871789845697757224b57584e75f27a0d758a8d4ac2f9d0c054e104b232108ef8a427d690c6ed7744f06806de320f48681bfe92b951ab49bb6ff1e4e11793

    Score
    3/10
    • Target

      arrowdown.svg

    • Size

      706B

    • MD5

      370b1a14d1e77006f779a39dd6dd3823

    • SHA1

      895367fdb0fae4ba321795779147c46b3e164899

    • SHA256

      49dfcb4513d28e86284b95f425c37bfe49c3eb2d6da932cc6f776e4316b450b4

    • SHA512

      4373e3a733694f7895e62d72b77032971afb7394654da3e9d7ca62f19bd0981e9dbbdec5c2e580937f3ad86fa1b2232c7c4b08d4fe53207910037f6d75d06ef5

    Score
    3/10
    • Target

      cup_sub.svg

    • Size

      552B

    • MD5

      cef20156f690e0ae4c40da5bb5101824

    • SHA1

      dce37bc26bc4d536f63b91ba6f0a01c349221c87

    • SHA256

      ea5c439f5ee0aa4882bea669488ecd308b8b9130a6cc7156ab6056372c2a016d

    • SHA512

      4ee919f3e1d5607643acbe1accb6e2251f578e2cce12cd16441a489dd7e6d0c6a3725ea4ae4eb6cc85f1df8b01a289f29371b5737b8a310bcb1702ad292de22b

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
7/10

behavioral1

alienbotcerberusbankerevasioninfostealerrattrojan
Score
10/10

behavioral2

alienbotcerberusbankerevasioninfostealerrattrojan
Score
10/10

behavioral3

alienbotcerberusbankerevasioninfostealerrattrojan
Score
10/10

behavioral4

Score
1/10

behavioral5

Score
3/10

behavioral6

Score
1/10

behavioral7

Score
3/10

behavioral8

Score
1/10

behavioral9

Score
3/10

behavioral10

Score
1/10

behavioral11

Score
3/10

behavioral12

Score
1/10

behavioral13

Score
3/10

behavioral14

Score
1/10

behavioral15

Score
3/10

behavioral16

Score
1/10

behavioral17

Score
3/10

behavioral18

Score
1/10

behavioral19

Score
3/10

behavioral20

Score
1/10

behavioral21

Score
3/10

behavioral22

Score
1/10

behavioral23

Score
3/10

behavioral24

Score
1/10

behavioral25

Score
3/10

behavioral26

Score
1/10

behavioral27

Score
3/10

behavioral28

Score
1/10

behavioral29

Score
3/10

behavioral30

Score
1/10

behavioral31

Score
3/10

behavioral32

Score
1/10