Analysis
- max time kernel
1835224s - max time network
166s - platform
android_x64 - resource
android-x64-20220310-en - submitted
16/06/2022, 16:37
Static task
static1
Behavioral task
behavioral1
Sample
6a03efa4ffa38032edfb5b604672e8c9e01a324f8857b5848e8160593dfb325e.apk
Resource
android-x86-arm-20220310-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6a03efa4ffa38032edfb5b604672e8c9e01a324f8857b5848e8160593dfb325e.apk
Resource
android-x64-20220310-en
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
6a03efa4ffa38032edfb5b604672e8c9e01a324f8857b5848e8160593dfb325e.apk
Resource
android-x64-arm64-20220310-en
0 signatures
0 seconds
General
- Target 6a03efa4ffa38032edfb5b604672e8c9e01a324f8857b5848e8160593dfb325e.apk
- Size 4.0MB
- Sample220616-t46p5aafc3
- SHA256 6a03efa4ffa38032edfb5b604672e8c9e01a324f8857b5848e8160593dfb325e
- MD5 1edd97885a8a7e88694be9971ac317e5
- SHA1 64c4b39176709a7fa9be936b925b17fb53544da9
- SHA512 2aa25bae46e2c3f1ebdd2360c378f711ebc40fe82f9541d6a52d48f3ee14f46801a7125d6b02afdeaa342dfd96b6b22017cf7011e81fad749ce864b1703a077a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- FluBot
FluBot is an android banking trojan that uses overlays.
- FluBot Payload 3 IoCs
resource yara_rule behavioral2/files/6194-0.dat family_flubot behavioral2/memory/6194-0.dex family_flubot behavioral2/memory/6194-1.dex family_flubot - Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws 6194 com.weico.international /data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws 6194 com.weico.international - Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.weico.international
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws
- Size 2.7MB
- SHA256 43aeff13359ef7e32a451cd4b92c92a0fe1e1379529908da360ad52ab536edee
- MD5 b1d614416713cac32114408e34bf65f8
- SHA1 6d359cdd25d13b7e407c60301ceec5d276b3580c
- SHA512 ef8b04cd045b89ef6ad4e1ecffa8dd45e7c7adc9a35e1f9648c13bc6c3fa1b916ef8fc592990806755801df460932c128a49836962d5a614858e3c695625786f
- SSDEEP 24576:wmiYczzs8r5phH1x+DtsOsawIBR2tkuFGbbFh3MLbgttWM:YXbZFs8LktAM
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws
- Size 2.7MB
- SHA256 43aeff13359ef7e32a451cd4b92c92a0fe1e1379529908da360ad52ab536edee
- MD5 b1d614416713cac32114408e34bf65f8
- SHA1 6d359cdd25d13b7e407c60301ceec5d276b3580c
- SHA512 ef8b04cd045b89ef6ad4e1ecffa8dd45e7c7adc9a35e1f9648c13bc6c3fa1b916ef8fc592990806755801df460932c128a49836962d5a614858e3c695625786f
- SSDEEP 24576:wmiYczzs8r5phH1x+DtsOsawIBR2tkuFGbbFh3MLbgttWM:YXbZFs8LktAM
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws
- Size 2.7MB
- SHA256 43aeff13359ef7e32a451cd4b92c92a0fe1e1379529908da360ad52ab536edee
- MD5 b1d614416713cac32114408e34bf65f8
- SHA1 6d359cdd25d13b7e407c60301ceec5d276b3580c
- SHA512 ef8b04cd045b89ef6ad4e1ecffa8dd45e7c7adc9a35e1f9648c13bc6c3fa1b916ef8fc592990806755801df460932c128a49836962d5a614858e3c695625786f
- SSDEEP 24576:wmiYczzs8r5phH1x+DtsOsawIBR2tkuFGbbFh3MLbgttWM:YXbZFs8LktAM
- MD5 SHA1 SHA512 SSDEEP