Analysis
-
max time kernel
1842113s -
max time network
149s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
16-06-2022 18:34
General
-
Target
6323ac65167e8d48c3bd6c8b839eb600b5b9be9b942e582640147be8d98cedb6.apk
-
Size
2.6MB
-
MD5
b65b16fb181011fdaf1fa4bcc22edf5b
-
SHA1
93c3c66ede2d13c5ec2325ee0f774a6808c0d7af
-
SHA256
6323ac65167e8d48c3bd6c8b839eb600b5b9be9b942e582640147be8d98cedb6
-
SHA512
6ea8a8c5ca4875707ac338236f9f945787a793ee125a41f8a4423d3e5b6339ddd8bf59432f17da5c1c98026001f797d0520b51bc0d16bafe68d931b202a10d76
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 4 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.baidu.searchbox1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.baidu.searchbox/app_apkprotector_dex/8CYbZjFp.blue --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.baidu.searchbox/app_apkprotector_dex/oat/x86/8CYbZjFp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD516e74e8e6081d78fc2f804d30072bac1
SHA146a2b5cc24ed7bf38150336254cb97900cebfdf1
SHA2564c84e63a079fc96c2905123315fe2471f80a460747631e47bb8f9bfd36c20fb0
SHA51208e1eec4271a23d3800516984c439a93299826c7786db9cc8808a46e8c2017af0d52bebac5558c1861cd4483ee3233adda361647b62e49863f106ccc31de226c
-
Filesize
2.3MB
MD516e74e8e6081d78fc2f804d30072bac1
SHA146a2b5cc24ed7bf38150336254cb97900cebfdf1
SHA2564c84e63a079fc96c2905123315fe2471f80a460747631e47bb8f9bfd36c20fb0
SHA51208e1eec4271a23d3800516984c439a93299826c7786db9cc8808a46e8c2017af0d52bebac5558c1861cd4483ee3233adda361647b62e49863f106ccc31de226c
-
Filesize
2.3MB
MD58d56defc502f14117efdecb2ed46ff94
SHA1d37fd01d8e4d2ca0f0e94330a26931ab81fdb6e0
SHA2563495302848d1a0296d345d83d5eac6315a0beaaf0ff20a0d73c8df3484f31870
SHA512f8eff072df79c6263162f06f5737eecc64abb7d24f7af9121e61f6fb56fce4cd82e8d730defd01dec527ea46fa4d687592dfabb88fbc44d791bb52525e48a338
-
Filesize
2.3MB
MD516e74e8e6081d78fc2f804d30072bac1
SHA146a2b5cc24ed7bf38150336254cb97900cebfdf1
SHA2564c84e63a079fc96c2905123315fe2471f80a460747631e47bb8f9bfd36c20fb0
SHA51208e1eec4271a23d3800516984c439a93299826c7786db9cc8808a46e8c2017af0d52bebac5558c1861cd4483ee3233adda361647b62e49863f106ccc31de226c