Analysis
-
max time kernel
1840406s -
max time network
166s -
platform
android_x64 -
resource
android-x64-arm64-20220310-en -
submitted
16-06-2022 18:04
General
-
Target
9f41dff89cd49eadea3d1e3b98b58402b9cda6b54eebc62a371568b5a607d849.apk
-
Size
3.0MB
-
MD5
6410a472bd0c90fa069bfacf10cdc840
-
SHA1
1a822e7e3f915353b723009c47b981048c847210
-
SHA256
9f41dff89cd49eadea3d1e3b98b58402b9cda6b54eebc62a371568b5a607d849
-
SHA512
87c34a6b9fd14dea07aa0ed9b7b4fd616b81b7aa6b9ebbd9c25297c4681735b7212b80da7a94fe740aed2073a799e6c111d538ebb1e2593c1cabf3c65a76fef6
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 3 IoCs
-
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.sina.weibo1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD51fa0650de1f76a916e2437be4e91e95b
SHA12675d553d5d33ac24adc2f191161ea9a53d72d8a
SHA2561a437fc2b6313e4e569e148583de5f35914a76c39bf51aadba4c9c75f0163017
SHA51261fdb8efd0755c786f7244790b40e8ebe4015409774c0f7bf1132efc29803d26d910b6a6a004d9fd196d75daffab367034b57112b54272f45437754a95fd40fc
-
Filesize
2.4MB
MD51fa0650de1f76a916e2437be4e91e95b
SHA12675d553d5d33ac24adc2f191161ea9a53d72d8a
SHA2561a437fc2b6313e4e569e148583de5f35914a76c39bf51aadba4c9c75f0163017
SHA51261fdb8efd0755c786f7244790b40e8ebe4015409774c0f7bf1132efc29803d26d910b6a6a004d9fd196d75daffab367034b57112b54272f45437754a95fd40fc
-
Filesize
2.4MB
MD51fa0650de1f76a916e2437be4e91e95b
SHA12675d553d5d33ac24adc2f191161ea9a53d72d8a
SHA2561a437fc2b6313e4e569e148583de5f35914a76c39bf51aadba4c9c75f0163017
SHA51261fdb8efd0755c786f7244790b40e8ebe4015409774c0f7bf1132efc29803d26d910b6a6a004d9fd196d75daffab367034b57112b54272f45437754a95fd40fc