Analysis
-
max time kernel
1842505s -
max time network
172s -
platform
android_x64 -
resource
android-x64-arm64-20220310-en -
submitted
16-06-2022 18:39
General
-
Target
Flubot49_2.apk
-
Size
4.8MB
-
MD5
c10d38a63e776e5940d281bddbb497d4
-
SHA1
ac0561ee9acc38c138409d03a24bdd992a5b1d96
-
SHA256
831334e1e49ec7a25375562688543ee75b2b3cc7352afc019856342def52476b
-
SHA512
a9ddd9f1f370c0a15fc4f777ccd1bad8e2c3c6ad1236561fe8dc8e44690498e095fe86b755af68d43c14dc9a85cd0f9bbda452463e7dcad1e4bcdb2901ce3da5
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 1 IoCs
-
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.qiyi.video1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD57e079768ccb1b3921f7e5f259d628057
SHA11bd568284cc86cf8cb2fe7f769816116609d5c1a
SHA2561f5d1129e95cac98b3f7baba1b0c8cee8aced5cc89730b4e066e703aec3233b8
SHA5125d981ae7b2242d3077b91767b404912b244c5495a1a87b19a492f0731aed0a791377f7b66705a5e54eb25bf74655a536472ad293dcb0cb77f78d99b4c5b0a0dc
-
Filesize
306B
MD5dd9130436664e461f68f845ba1cfe1b9
SHA10c9babd59dea8ac4ece4cb492f936d54d11aa4e0
SHA256012d74d213405812cd3e2cab5b4f610d6caab880ffde68abae489f0aa16e1a34
SHA5122f8c5ffda5c438edb6a910010ce0128de546a90d83d102834f23c63ead5a336c026eb96951ff0b965e19b485e4cbff7555f881ab177cfc9b308a8e8acc481700