Analysis
-
max time kernel
4062035s -
max time network
174s -
platform
android_x64 -
resource
android-x64-arm64 -
submitted
29-07-2021 11:51
General
-
Target
373c2b77c58c03b04d7972a004490306f28b83679a35deb104e53cb21918fa4b.apk
-
Size
3.0MB
-
MD5
3b2255d30c0219d4073fe73b4b65f00e
-
SHA1
1de2e5082e302242e768cc00d37283d93399e5c8
-
SHA256
373c2b77c58c03b04d7972a004490306f28b83679a35deb104e53cb21918fa4b
-
SHA512
68ebcb91c53bfd634e62b0f8c64f6463f7936a1da4978e8467762a5e72676606fd50321850782aedac02d6fccf9f4e84ae8b86953e4d73ecfa30360d4be5c65b
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 1 IoCs
-
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
-
Uses reflection 64 IoCs
Processes
-
com.xunmeng.pinduoduo1⤵
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data).
- Uses reflection
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/WqsTtsRz.iotMD5
2b8bd704cd0664504f9fdb8dae05c957
SHA10ce4c4200453439ffa1aa38deafd288d61708dd6
SHA256ccc7094f0482fa12e2847f2e01730f077c3b2f1d7d1d1991bd5435cfa77b9f0c
SHA512c843d8912c23972efa9f8372e779bc6b8e94fadb5e28387aba1080a5643340ea968b9130dc5ca6443bea19a6626d04ee71105f2dc55d686642b14d6ffb4592bc
-
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/WqsTtsRz.iotMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/WqsTtsRz.iotMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xmlMD5
dac00789dd6cb5e34b2f1dc4a35f9fa7
SHA139d1e3612a91f162b1039cc5a2116fc76a31e141
SHA2562a907842edab86b6ac41ada50dd656a6e054662f18c03cd5dbfad3f008689e90
SHA512279aa6dc89f15b37972d14dd38625825872ff6d07c0d997bf332ab93d489b4e439cb2c7473ef4f7b30a705eee78b670b66e425521f64bc07ab1fa531c502975e
-
/data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xmlMD5
04175aa3d2b67a08235aa2d534ad8871
SHA1136891330acc4f839d57bd83d10d494cf46a5890
SHA2562898648d41a6c2845922566e46efa50cd610a8b26d33ddd5718579714c403861
SHA512fadbec4fbe604cd106a4c875d8ac496608d542f6416eaf717aa394c7eefd76f41f37ff0d31a9eec407dbecceabf074f69a012b591ecc58873e07bf9e64902c3d