Analysis
-
max time kernel
3085736s -
platform
android_x86 -
resource
android-x86-arm -
submitted
14-12-2021 08:48
General
-
Target
DHL52.apk
-
Size
5.3MB
-
MD5
61ff170d4f7dabc86da8fb0f60bf36ad
-
SHA1
3ba9a692d3d62284f279c75e4cfa0e5b69184e72
-
SHA256
af83e659196774e779b22038e11c4b0a4665d082064fe997510634000fdb0222
-
SHA512
937cc378c9a71bcddc6a798ff53374cb260363fc683ced7ea9130ff21a6071ff04bad8f2eda907172bc665f9d9cd0d8e9da3028a79684e73f26a9bb46ea5d2a2
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 2 IoCs
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.tencent.mobileqq1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data).
-
com.tencent.mobileqq2⤵
-
/system/bin/dex2oat2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.tencent.mobileqq/jHwGgGIkjH/8FgGfuGIffIwUtG/base.apk.iyt88Gw1.gIIMD5
409f60505488fa3a2e24c5fabcd583a8
SHA18d78b836cd45bccee03251ad88fbe056cae3ce69
SHA256fa0856e29785263d9fdb85313bb5752d577aa750e00b703a1f277ea9c5001f37
SHA51201653ed469fb21dcad96ee9005c7adc3f6b403f376222e888e8ae822929a7bc2f0a502294a203bb617ad606ccbc832376cff4d6e8efcad8a4992e2c928cf090e
-
/data/user/0/com.tencent.mobileqq/jHwGgGIkjH/8FgGfuGIffIwUtG/base.apk.iyt88Gw1.gIIMD5
409f60505488fa3a2e24c5fabcd583a8
SHA18d78b836cd45bccee03251ad88fbe056cae3ce69
SHA256fa0856e29785263d9fdb85313bb5752d577aa750e00b703a1f277ea9c5001f37
SHA51201653ed469fb21dcad96ee9005c7adc3f6b403f376222e888e8ae822929a7bc2f0a502294a203bb617ad606ccbc832376cff4d6e8efcad8a4992e2c928cf090e