Overview

overview

10

Static

static

7

Voicemail52.apk

android_x64

10

Analysis

  • max time kernel
    1554028s
  • max time network
    167s
  • platform
    android_x64
  • resource
    android-x64-arm64
  • submitted
    26-11-2021 14:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Voicemail52.apk

  • Size

    5.0MB

  • MD5

    5e3fb4a6f144335016f5d0773b0113fd

  • SHA1

    1a555e9e7f65ebe7ab2c6a48e126c63bb38e7612

  • SHA256

    36158735c5442bb6a2f5432226403905551f360d7ce99fa51e9d2b54b7cd02e7

  • SHA512

    cd0aeedac720253a5ef1afbdfdaed7c7db9efa13c3423c329a83917746ca9cdc968ab4c01f2ee07dac6093a497d6224c0849348ade75d51b635411bf280ad340

Score
10/10
flubotbankerinfostealerransomwaretrojan

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

    bankertrojaninfostealerflubot
  • FluBot Payload 1 IoCs
  • Makes use of the framework's Accessibility service. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.snda.wifilocating
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4101

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/base.apk.ki5fhf91.hre
    MD5

    3231abf45dda8eabf4554dfca61af489

    SHA1

    02c74432bcc3b377578ccd9906a67bdf42f31bc1

    SHA256

    0e8e17046fed1d67c50ab29ed8588f19747b466158b57816fde1a88cfcddd5ef

    SHA512

    630427645277d5dfb700daa8cf7b38af0b0b34c5c13b011d41602be803e999f5ba29b58053d6083f2e583d9555f6a9e1808158cc207edfb38ed7ad8d2bddbc13

    Download Submit