Analysis
- max time kernel
4179521s - max time network
162s - platform
android_x64 - resource
android-x64 - submitted
14/02/2022, 16:41
General
- Target b2dafc4faea81f4addf1ac3a295627e9f7e1d36efa2a8b82a813d853cfcf87c4.apk
- Size 5.6MB
- Sample220214-t64csaacf7
- SHA256 b2dafc4faea81f4addf1ac3a295627e9f7e1d36efa2a8b82a813d853cfcf87c4
Score
10/10
Malware Config
Signatures
- FluBot
FluBot is an android banking trojan that uses overlays.
- FluBot Payload 1 IoCs
- Checks Qemu related system properties. 1 IoCs
Checks for Android system properties related to Qemu for Emulator detection.
- Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.autonavi.minimap1⤵
- Checks Qemu related system properties.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).