Analysis
-
max time kernel
1841371s -
max time network
180s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
16-06-2022 18:20
General
-
Target
76190371f81113c07f2a176f26e61bea82f8f55debe2915c577f4ebe1b22f252.apk
-
Size
6.8MB
-
MD5
7a9a3c3c37885357227fb211984bbd40
-
SHA1
8046275ad75ef2bdbf1f21f6c64d36563d5b06f4
-
SHA256
76190371f81113c07f2a176f26e61bea82f8f55debe2915c577f4ebe1b22f252
-
SHA512
f854d84d80bed707e9252700cfc8dfdd53132a7a9e1db0a64fafc3b01568a7970e1d73c3a23f169a76ed709aef7b58988c2dff86281fbe0eb535bb7becdf9499
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 3 IoCs
-
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.tencent.mobileqq1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mobileqq/app_DynamicOptDex/ycKc.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mobileqq/app_DynamicOptDex/oat/x86/ycKc.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD560c429c92b31cf2056b6b34a23762e5b
SHA15ce0b38b8a52c47002d21e32a7ac0a01e4c561c0
SHA2565560970a6a5de549ccd9e28b851a5ee218449097b30e06529c6ea0fabd6f842a
SHA512951c2286ab0e2824ab0dc5d5b21a7bfd8a4880ba9b53b8bb59e73ab2edf6797abdbd429110b18d48d4335111ac538436e38376339ab1aa526eb849f16d6529df
-
Filesize
3.1MB
MD5ad8465c129549af17e79674174d034f0
SHA168d7f89e3f976b5ad66fcf9eb9b881259a41c8fb
SHA25641dd1e6416de4f990cfbc24ad3d9dc6bf830d2028adff42202bc5587fbf4c668
SHA51284f87c7f23c9e73d342ef5aca9bacf25dcce00d1b76c38d01b2678cf72c82689a62e41adfc77060d80e170ea8aece7022bc407c5f38065c7f4873f14de9df29e
-
Filesize
3.1MB
MD5e0ce873a45d32bd641a0a4981e46fbe8
SHA1f5970c914d369b828ca047d7a82c09167718c85f
SHA2566f28b5814816ab869a28068f78811a555fb51d6e686ead3241a5827be5fb708b
SHA5126ab787cfab7a19aca2d9d6e5b216fb57922d394afb830cd627b44a9a0b1d914f813b5a69ff712609507e97203f2c9aeb2b5aa1bf01275b17ece3f84ac06f6ac9
-
Filesize
3.1MB
MD5ad8465c129549af17e79674174d034f0
SHA168d7f89e3f976b5ad66fcf9eb9b881259a41c8fb
SHA25641dd1e6416de4f990cfbc24ad3d9dc6bf830d2028adff42202bc5587fbf4c668
SHA51284f87c7f23c9e73d342ef5aca9bacf25dcce00d1b76c38d01b2678cf72c82689a62e41adfc77060d80e170ea8aece7022bc407c5f38065c7f4873f14de9df29e