Overview

overview

10

Static

static

8

Android APK

android_x64

10

Analysis

  • max time kernel
    2259138s
  • max time network
    120s
  • platform
    android_x64
  • resource
    android-x64
  • submitted
    08-07-2021 15:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dafb93de9a09a2723cc17698a6eceb7d7c2e96e347bdf46290e1276c58da9116.apk

  • Size

    3.2MB

  • MD5

    560e62a1da35b2e2dc131951bcbe7c1b

  • SHA1

    bac4afc22c450224270ea112c4a7bb35ed229c5c

  • SHA256

    dafb93de9a09a2723cc17698a6eceb7d7c2e96e347bdf46290e1276c58da9116

  • SHA512

    a86ee05297be137d9cb685e1636f9bc97204833e8c7ecbbad8bb8b7b53389c53a46ca718cd2de6fe03d6ea7c91b53b3098340d070cc897cdfda92d61b04756cc

Score
10/10
flubotbankerinfostealerobfuscationransomwaretrojan

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

    bankertrojaninfostealerflubot
  • FluBot Payload 2 IoCs
  • Loads dropped Dex/Jar 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings. 1 IoCs
  • Reads name of network operator 1 IoCs

    Uses Android APIs to discover system information.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware
  • Uses reflection 64 IoCs
    obfuscation

Processes

  • com.didiglobal.passenger
    1⤵
    • Loads dropped Dex/Jar
    • Requests enabling of the accessibility settings.
    • Reads name of network operator
    • Uses Crypto APIs (Might try to encrypt user data).
    • Uses reflection
    PID:3594

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.didiglobal.passenger/app_ded/rxJWkoGtS5ILg93TXQCyoByk4wMldNzn.dex
    MD5

    c51431fb4e8dadbc5eaacf03981b2e85

    SHA1

    1c0936e594917be28ea751b4668c55bd6bc5502f

    SHA256

    3b68a74d0eaaf821ef69a538edd49e121e3da787220d563d64c4d75822b4c253

    SHA512

    304f621cb734e6e381e29e810a9bc93791e2a9227447d31d82bc8a9b03657ac1c242043340a5d41c57d4d17a33a28c6775db598cb3f9d9959338c7ee9b9ae534

    Download Submit
  • /data/user/0/com.didiglobal.passenger/app_ded/rxJWkoGtS5ILg93TXQCyoByk4wMldNzn.dex
    Download Submit
  • /data/user/0/com.didiglobal.passenger/app_ded/rxJWkoGtS5ILg93TXQCyoByk4wMldNzn.dex
    MD5

    c51431fb4e8dadbc5eaacf03981b2e85

    SHA1

    1c0936e594917be28ea751b4668c55bd6bc5502f

    SHA256

    3b68a74d0eaaf821ef69a538edd49e121e3da787220d563d64c4d75822b4c253

    SHA512

    304f621cb734e6e381e29e810a9bc93791e2a9227447d31d82bc8a9b03657ac1c242043340a5d41c57d4d17a33a28c6775db598cb3f9d9959338c7ee9b9ae534

    Download Submit
  • /data/user/0/com.didiglobal.passenger/cache/src2107271891008286766
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.didiglobal.passenger/cache/src2107271891008286766/dp.kotlin-v1.lua.mph
    MD5

    c384c5cdaf8f3edfa29389f2de2effea

    SHA1

    5e5dad9692cf5794e3ff7b99a64e6555399bc56f

    SHA256

    0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

    SHA512

    7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

    Download Submit
  • /data/user/0/com.didiglobal.passenger/cache/src2107271891008286766/dp.kotlin-v1.lua.mph
    MD5

    c384c5cdaf8f3edfa29389f2de2effea

    SHA1

    5e5dad9692cf5794e3ff7b99a64e6555399bc56f

    SHA256

    0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

    SHA512

    7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

    Download Submit
  • /data/user/0/com.didiglobal.passenger/cache/src2107271891008286766/dp.kotlin-v1.lua.mph
    MD5

    c384c5cdaf8f3edfa29389f2de2effea

    SHA1

    5e5dad9692cf5794e3ff7b99a64e6555399bc56f

    SHA256

    0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

    SHA512

    7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

    Download Submit
  • /data/user/0/com.didiglobal.passenger/shared_prefs/bpost.xml
    MD5

    1454b810052a59f32a52d2f6b66ece43

    SHA1

    436e6e0dd50b7757a86e32e2bff8dfee3fc15760

    SHA256

    4ee2cb2880a423e24bf53afeb3dcb892d075bc0cc29b72def0c1a55b631d0781

    SHA512

    c0aa64c101bb64c5a4043be9b6b7518d07748bbdfa73686a87e584e94fba70506fcdbe6cff355b1367e0040a0ca0e1f855a67cdb2726da140363e4ef437ad97d

    Download Submit
  • /data/user/0/com.didiglobal.passenger/shared_prefs/bpost.xml
    MD5

    f8597a09627542c1279fe6e40dac18f4

    SHA1

    dcfa1f8a0d563a6577179d96ffc309c68d25759e

    SHA256

    9f7daf5e8e0527d97afc1eaf2587d486fe3f03ffa56ed7b21a21a156a88e0c62

    SHA512

    e3106b2d48bb380c71b6d797a03e568dbcbbe1e93f64a8d25c9bf12958ed6483c4445dd38b3f7237720c816e9c038afa07be3f3949f78706e318617dffbb9632

    Download Submit