Analysis
-
max time kernel
1844567s -
max time network
37s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
16-06-2022 18:15
General
-
Target
4d3ea6e701b950516b89a4be889a31635e9f892705f34345017d323bfcd6e110.apk
-
Size
4.0MB
-
MD5
6f049fc4e5f85d53d1aaa158412edca3
-
SHA1
d23d638b224dbbdb6ace0bdc3271fc17a924007c
-
SHA256
4d3ea6e701b950516b89a4be889a31635e9f892705f34345017d323bfcd6e110
-
SHA512
084ade2f99dbc69de0d4c84535756da2db8f894b56f610826437d80e3747de39a08508c4411f2f2cfeef05639534a13e47e2737e0033c6b881f60781d2d20fde
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 4 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.tencent.mobileqq1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/1ZSxwFVb.k7s --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/oat/x86/1ZSxwFVb.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD53da316472c35bd207a98bfd04b4244ce
SHA14bad0a3c4627a0ebf0bcaa1e327eb243ca9d449e
SHA25658d6ae1d358508675cf791bbb3de96b8d8c97bbb960bc4075f8899cf2386baf6
SHA512e9331106619ff5dd8670471fe989d58b35dbf976f59e4fad2c8a07247d348b3eb513d3a0d6ccbb5a7620183062d5a1c30abcc5a5a61c843abd2d5f436b3ce406
-
Filesize
2.7MB
MD53da316472c35bd207a98bfd04b4244ce
SHA14bad0a3c4627a0ebf0bcaa1e327eb243ca9d449e
SHA25658d6ae1d358508675cf791bbb3de96b8d8c97bbb960bc4075f8899cf2386baf6
SHA512e9331106619ff5dd8670471fe989d58b35dbf976f59e4fad2c8a07247d348b3eb513d3a0d6ccbb5a7620183062d5a1c30abcc5a5a61c843abd2d5f436b3ce406
-
Filesize
2.7MB
MD54a29c1a263b09ba42ffed6ae8550565a
SHA1c3e5f75cdc8dbd353c0a2158406def08b104f65b
SHA25697add5be513f41932be3205a8a09baf66f68e3f5e46bedd7052f99a46c59a37d
SHA51225730bf7e4fe9327caa95518e31414bba7bf4599fced9b518f0e6d90bdcbec4cd3b19579ba756430d89ec34eefd647ecce9a0d2b2a1076771519589122f904ae
-
Filesize
2.7MB
MD53da316472c35bd207a98bfd04b4244ce
SHA14bad0a3c4627a0ebf0bcaa1e327eb243ca9d449e
SHA25658d6ae1d358508675cf791bbb3de96b8d8c97bbb960bc4075f8899cf2386baf6
SHA512e9331106619ff5dd8670471fe989d58b35dbf976f59e4fad2c8a07247d348b3eb513d3a0d6ccbb5a7620183062d5a1c30abcc5a5a61c843abd2d5f436b3ce406