Analysis
-
max time kernel
1842273s -
max time network
163s -
platform
android_x64 -
resource
android-x64-arm64-20220310-en -
submitted
16-06-2022 18:35
General
-
Target
16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19a.apk
-
Size
3.3MB
-
MD5
7e97532091767c01d5b426c4d0726fff
-
SHA1
99828b200a44302507ed272c3fad84cc9747924d
-
SHA256
16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19
-
SHA512
7994e440985226af7455f58e1f54bd37ad51fd27999d5c8023d240eb966111fb8058e6dcf183aeb8566d648f5f5d6d22d5f76a016649a7e7f7c5a9729792cb64
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 3 IoCs
-
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.tencent.westarthk1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD51be07a7baad9b4a2a0580a8e60629658
SHA126253e76f2fa7ea97b9d406281fbd1586a1f0aaa
SHA256f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334
SHA512c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4
-
Filesize
1.5MB
MD51be07a7baad9b4a2a0580a8e60629658
SHA126253e76f2fa7ea97b9d406281fbd1586a1f0aaa
SHA256f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334
SHA512c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4
-
Filesize
1.5MB
MD51be07a7baad9b4a2a0580a8e60629658
SHA126253e76f2fa7ea97b9d406281fbd1586a1f0aaa
SHA256f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334
SHA512c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4
-
Filesize
120KB
MD5c384c5cdaf8f3edfa29389f2de2effea
SHA15e5dad9692cf5794e3ff7b99a64e6555399bc56f
SHA2560f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062
SHA5127ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780
-
Filesize
120KB
MD5c384c5cdaf8f3edfa29389f2de2effea
SHA15e5dad9692cf5794e3ff7b99a64e6555399bc56f
SHA2560f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062
SHA5127ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780
-
Filesize
120KB
MD5c384c5cdaf8f3edfa29389f2de2effea
SHA15e5dad9692cf5794e3ff7b99a64e6555399bc56f
SHA2560f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062
SHA5127ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780