Analysis
-
max time kernel
1737168s -
max time network
137s -
platform
android_x64 -
resource
android-x64-arm64-20220310-en -
submitted
15-06-2022 13:23
General
-
Target
831334e1e49ec7a25375562688543ee75b2b3cc7352afc019856342def52476b.apk
-
Size
4.8MB
-
MD5
c10d38a63e776e5940d281bddbb497d4
-
SHA1
ac0561ee9acc38c138409d03a24bdd992a5b1d96
-
SHA256
831334e1e49ec7a25375562688543ee75b2b3cc7352afc019856342def52476b
-
SHA512
a9ddd9f1f370c0a15fc4f777ccd1bad8e2c3c6ad1236561fe8dc8e44690498e095fe86b755af68d43c14dc9a85cd0f9bbda452463e7dcad1e4bcdb2901ce3da5
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 1 IoCs
-
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.qiyi.video1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD57e079768ccb1b3921f7e5f259d628057
SHA11bd568284cc86cf8cb2fe7f769816116609d5c1a
SHA2561f5d1129e95cac98b3f7baba1b0c8cee8aced5cc89730b4e066e703aec3233b8
SHA5125d981ae7b2242d3077b91767b404912b244c5495a1a87b19a492f0731aed0a791377f7b66705a5e54eb25bf74655a536472ad293dcb0cb77f78d99b4c5b0a0dc
-
Filesize
306B
MD5a24cd5333862ab51cb6640c0626de93c
SHA1994ccdabbaf0c1114c03c9305fca2abb8e64cac3
SHA256e9528c681e6f51ef5ba536d49e454726fc3f33c7577506911e69331c7dcc3630
SHA512e558cd6c8a4fb3b7526db7e7b0bd00c8f12c2830e8a1ab1870a67e2572003d396a6d41547c7dc6e020197f0ab0d9d19cdbd6c0ab16cfea2542dcb79ea5447ed8