Analysis
- max time kernel
2690126s - max time network
1873s - platform
android_x64 - resource
android-x64-arm64 - submitted
28/01/2022, 10:28
General
- Target df98a8b9f15f4c70505d7c8e0c74b12ea708c084fbbffd5c38424481ae37976f.apk
- Size 5.5MB
- Sample220128-mh7a7sbbak
- SHA256 df98a8b9f15f4c70505d7c8e0c74b12ea708c084fbbffd5c38424481ae37976f
Score
10/10
Malware Config
Signatures
- FluBot
FluBot is an android banking trojan that uses overlays.
- FluBot Payload 1 IoCs
- Makes use of the framework's Accessibility service. 1 IoCs
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
- Acquires the wake lock. 1 IoCs
- Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.tencent.mobileqq1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).