General

  • Target

    d6d2b6de7856b8cb1dc803b7ea26cc7982d4f22b4cbd890c1dfe4faf14ed319d.apk

  • Size

    3.3MB

  • Sample

    220616-xbjxfabbd3

  • MD5

    5fcd8c59f18c7d20f46b21409ecd5b9d

  • SHA1

    8ecb08a2bbbdf0e47b8d62af476708c4b5710818

  • SHA256

    d6d2b6de7856b8cb1dc803b7ea26cc7982d4f22b4cbd890c1dfe4faf14ed319d

  • SHA512

    a854cd6e54335458229d2a05b3334d33a3d71e0d0017972d8fefbe2f394b9ebca7e181e8bdcbc6b5ee005f6534f279ed79b67c5f8c77a7fc07a30bc167d18b7e

Malware Config

Targets

    • Target

      d6d2b6de7856b8cb1dc803b7ea26cc7982d4f22b4cbd890c1dfe4faf14ed319d.apk

    • Size

      3.3MB

    • MD5

      5fcd8c59f18c7d20f46b21409ecd5b9d

    • SHA1

      8ecb08a2bbbdf0e47b8d62af476708c4b5710818

    • SHA256

      d6d2b6de7856b8cb1dc803b7ea26cc7982d4f22b4cbd890c1dfe4faf14ed319d

    • SHA512

      a854cd6e54335458229d2a05b3334d33a3d71e0d0017972d8fefbe2f394b9ebca7e181e8bdcbc6b5ee005f6534f279ed79b67c5f8c77a7fc07a30bc167d18b7e

    • FluBot

      FluBot is an android banking trojan that uses overlays.

    • FluBot Payload

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    • suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses

      suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks