Analysis

  • max time kernel
    1840858s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    16/06/2022, 18:11

General

  • Target
    fe52bed001f28a4b218bcd0ad31b92fb59022778cf68a1445cf3e8c612a5e04c.apk
  • Size 4.2MB
  • Sample220616-ws2cdagebm
  • SHA256 fe52bed001f28a4b218bcd0ad31b92fb59022778cf68a1445cf3e8c612a5e04c
  • MD5 SHA1 SHA512

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

  • FluBot Payload 3 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.tencent.mobileqq
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:6189

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ISM4bLeG.ood

        • Path /data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood
        • Size 6.5MB
        • SHA256 6c0bd313d36ac2d0180a8ccd6d7416fc7f0f56781e00128af6a67772d46707d6
        • MD5 SHA1 SHA512 SSDEEP

        ISM4bLeG.ood

        • Path /data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood
        • Size 6.5MB
        • SHA256 6c0bd313d36ac2d0180a8ccd6d7416fc7f0f56781e00128af6a67772d46707d6
        • MD5 SHA1 SHA512 SSDEEP

        ISM4bLeG.ood

        • Path /data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood
        • Size 6.5MB
        • SHA256 6c0bd313d36ac2d0180a8ccd6d7416fc7f0f56781e00128af6a67772d46707d6
        • MD5 SHA1 SHA512 SSDEEP