Analysis
-
max time kernel
4059015s -
max time network
128s -
platform
android_x64 -
resource
android-x64 -
submitted
29-07-2021 11:01
Static task
static1
Behavioral task
behavioral1
Sample
3fd63767e496f24015ff603de5ce964d1b62033c7eb651eda28d6cbe1ebf5835.apk
Resource
android-x64
General
-
Target
3fd63767e496f24015ff603de5ce964d1b62033c7eb651eda28d6cbe1ebf5835.apk
-
Size
3.0MB
-
MD5
3ab4aae038f6b206de84cbc129849a47
-
SHA1
9a4eacacd7c1146e59757a3911e1b472da0286c9
-
SHA256
3fd63767e496f24015ff603de5ce964d1b62033c7eb651eda28d6cbe1ebf5835
-
SHA512
ac71119098107b772919629dee96d26c3ee0ea7f0753356032fcfccc525ae503d7d85ee2edacc7893c61e3e002bd74fa557721ede62092cf94e349ff7ea8be2a
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 1 IoCs
Processes:
resource yara_rule /data/user/0/com.tencent.qqmusic/app_apkprotector_dex/9ma3A6v5.hills family_flubot -
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.tencent.qqmusicioc pid process /data/user/0/com.tencent.qqmusic/app_apkprotector_dex/9ma3A6v5.hills 3594 com.tencent.qqmusic /data/user/0/com.tencent.qqmusic/app_apkprotector_dex/9ma3A6v5.hills 3594 com.tencent.qqmusic -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
com.tencent.qqmusicdescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS com.tencent.qqmusic -
Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
Processes:
com.tencent.qqmusicdescription ioc process Framework API call android.telephony.TelephonyManager.getNetworkOperatorName com.tencent.qqmusic -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
com.tencent.qqmusicdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.tencent.qqmusic -
Uses reflection 64 IoCs
Processes:
com.tencent.qqmusicdescription pid process Invokes method android.view.ViewGroup.makeOptionalFitsSystemWindows 3594 com.tencent.qqmusic Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3594 com.tencent.qqmusic
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.tencent.qqmusic/app_apkprotector_dex/9ma3A6v5.hillsMD5
751217a6c357669839a818fe3658273a
SHA1b4cf8a9976c5705eef891a40897d56d9d85a84bd
SHA256614faccfe37495c23ed962695ddc66efd2b6b212c33166d4558b69a8a494375d
SHA512a8eb5347762a98cf6c2b6e8ba557878a92a54c096499121f58bd71da3773cefef6b3b7d4f004fb744840b982309db244b4a2daec71839568a272caf207c0cf7d
-
/data/user/0/com.tencent.qqmusic/app_apkprotector_dex/9ma3A6v5.hillsMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.tencent.qqmusic/app_apkprotector_dex/9ma3A6v5.hillsMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.tencent.qqmusic/shared_prefs/Voicemail.xmlMD5
50730246bf539abadac627122f6f5dd7
SHA15c8a6ed468e8466e2b347f2132a474ab433b3822
SHA2563a773fcaf9810a6ad98e467594b01b3d8918fb8678af63b51eefd47213208d60
SHA512e65365ce530bccca6e57bc6863a50cdbbbce3b1d69c0fa429f72797d8c75372829d22fb7178833e9c04e817f5143815157598866d3ed2666a23f8b781055daab
-
/data/user/0/com.tencent.qqmusic/shared_prefs/Voicemail.xmlMD5
5b647c2c83401fd08fa6a6ebdf25de53
SHA108b6495562ab50df0e0d7407da1c756ee0e7b56c
SHA256cca23a07ef300f193866f539ebb469c5b3361327faf1a728eb496ea392f961d4
SHA512f0e9ceb58d4a786c0cd86c9a245cd35d44f0efb3b89c8ed4df0a890b241f0b7e6244215caab86f0f392d44792d2b2e540be4d374fc5624b8c7b521af6a85ce4d