Resubmissions

24/05/2022, 16:23

220524-tv7aasdban10

12/05/2022, 07:29

220512-jbdhrsbae310

Analysis

  • max time kernel
    3073278s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    12/05/2022, 07:29

General

  • Target
    739616a8a8b6081d3a28d8aae27aa54f2345529cf804a039ba840286c65b5cdc.apk
  • Size 5.4MB
  • Sample220512-jbdhrsbae3
  • SHA256 739616a8a8b6081d3a28d8aae27aa54f2345529cf804a039ba840286c65b5cdc
  • MD5 SHA1 SHA512

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

  • FluBot Payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.tencent.mobileqq
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:6182

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        base.apk.afyggId1.hgr

        • Path /data/user/0/com.tencent.mobileqq/yfjgfwgj8u/F8Gtjep8dgeggu7/base.apk.afyggId1.hgr
        • Size 2.1MB
        • SHA256 49a7acf87393e2926d3165f89ed8d7aea806a54161a1608321e88c20cd64ae11
        • MD5 SHA1 SHA512 SSDEEP