Overview

overview

10

Static

static

7

DHL1.apk

android_x86

10

DHL1.apk

android_x64

10

DHL1.apk

android_x64

10

Analysis

  • max time kernel
    3834024s
  • max time network
    149s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    01-04-2022 09:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DHL1.apk

  • Size

    5.3MB

  • MD5

    d8344f575dd39cbdee2949b98d86139a

  • SHA1

    46fb041f19b442767c043f0fae022b1d590b79a9

  • SHA256

    5b404c066e702802b7475d2c2eecebd6fceb2490773f92d501d57b53de34213c

  • SHA512

    6be54056802de48f65dca16ef8b23fbaa9e97282aea4a33b0e614a67b08917ec30ef346114dd9c5b01444e33a0caa88c7bd9cd610c5c77c98a8bce3d2dea5259

Score
10/10
flubotbankerinfostealerransomwaretrojan

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

    bankertrojaninfostealerflubot
  • FluBot Payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.qq.reader
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:6057

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.qq.reader/jGiefIef87/gg98jge8gkk9ygj/base.apk.Is7kg8a1.kTf
    Filesize

    2.0MB

    MD5

    d7ed16135455651a9c27ed64fa9e4b9d

    SHA1

    64ddba7afd5fe5c497d2e1c4daab52d85673551f

    SHA256

    029784101cbd495a99268581c38010b03679cebdb7a34a0f91e424044a51f75c

    SHA512

    72abc4fffc490200c0c2ce3c4fa8f37139b9d3cd2db2c55d84d568b3764c584159da29a40046d0d7b5ca2ba7f11275bc708fa56460ee6dd80de3b330a1dbffa7

    Download Submit