Analysis

  • max time kernel
    1835224s
  • max time network
    166s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    16/06/2022, 16:37

General

  • Target
    6a03efa4ffa38032edfb5b604672e8c9e01a324f8857b5848e8160593dfb325e.apk
  • Size 4.0MB
  • Sample220616-t46p5aafc3
  • SHA256 6a03efa4ffa38032edfb5b604672e8c9e01a324f8857b5848e8160593dfb325e
  • MD5 SHA1 SHA512

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

  • FluBot Payload 3 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.weico.international
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:6194

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        5xae4yYD.aws

        • Path /data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws
        • Size 2.7MB
        • SHA256 43aeff13359ef7e32a451cd4b92c92a0fe1e1379529908da360ad52ab536edee
        • MD5 SHA1 SHA512 SSDEEP

        5xae4yYD.aws

        • Path /data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws
        • Size 2.7MB
        • SHA256 43aeff13359ef7e32a451cd4b92c92a0fe1e1379529908da360ad52ab536edee
        • MD5 SHA1 SHA512 SSDEEP

        5xae4yYD.aws

        • Path /data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws
        • Size 2.7MB
        • SHA256 43aeff13359ef7e32a451cd4b92c92a0fe1e1379529908da360ad52ab536edee
        • MD5 SHA1 SHA512 SSDEEP