Analysis
- max time kernel
1835957s - max time network
170s - platform
android_x64 - resource
android-x64-arm64-20220310-en - submitted
16/06/2022, 16:50
General
- Target Flubot49.apk
- Size 4.3MB
- Sample220616-vb9fzsaff8
- SHA256 6e3499a5e63209b34ccc787a7ea57953ff5436b51ca4325ea0da4a958f44ea7b
Score
10/10
Malware Config
Signatures
- FluBot
FluBot is an android banking trojan that uses overlays.
- FluBot Payload 1 IoCs
- suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
- suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
- Makes use of the framework's Accessibility service. 1 IoCs
- Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
- Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.tencent.qqpimsecure1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
base.apk.hYfhdah1.jlY
multidex.version.xml