Overview

overview

10

Static

static

7

DHL1.apk

android_x86

10

DHL1.apk

android_x64

10

DHL1.apk

android_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL1.apk

  • Size

    5.3MB

  • Sample

    220401-lq2v1sebep

  • MD5

    d8344f575dd39cbdee2949b98d86139a

  • SHA1

    46fb041f19b442767c043f0fae022b1d590b79a9

  • SHA256

    5b404c066e702802b7475d2c2eecebd6fceb2490773f92d501d57b53de34213c

  • SHA512

    6be54056802de48f65dca16ef8b23fbaa9e97282aea4a33b0e614a67b08917ec30ef346114dd9c5b01444e33a0caa88c7bd9cd610c5c77c98a8bce3d2dea5259

Score
10/10
flubotandroidbankerevasioninfostealerransomwaretrojan

Malware Config

Targets

    • Target

      DHL1.apk

    • Size

      5.3MB

    • MD5

      d8344f575dd39cbdee2949b98d86139a

    • SHA1

      46fb041f19b442767c043f0fae022b1d590b79a9

    • SHA256

      5b404c066e702802b7475d2c2eecebd6fceb2490773f92d501d57b53de34213c

    • SHA512

      6be54056802de48f65dca16ef8b23fbaa9e97282aea4a33b0e614a67b08917ec30ef346114dd9c5b01444e33a0caa88c7bd9cd610c5c77c98a8bce3d2dea5259

    Score
    10/10
    flubotbankerevasioninfostealerransomwaretrojan

    • FluBot

      FluBot is an android banking trojan that uses overlays.

      bankertrojaninfostealerflubot

    • FluBot Payload

    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

      banker

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    • Removes a system notification.

      evasion

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks