Analysis
-
max time kernel
1842571s -
max time network
152s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
16-06-2022 18:40
General
-
Target
d6d2b6de7856b8cb1dc803b7ea26cc7982d4f22b4cbd890c1dfe4faf14ed319d.apk
-
Size
3.3MB
-
MD5
5fcd8c59f18c7d20f46b21409ecd5b9d
-
SHA1
8ecb08a2bbbdf0e47b8d62af476708c4b5710818
-
SHA256
d6d2b6de7856b8cb1dc803b7ea26cc7982d4f22b4cbd890c1dfe4faf14ed319d
-
SHA512
a854cd6e54335458229d2a05b3334d33a3d71e0d0017972d8fefbe2f394b9ebca7e181e8bdcbc6b5ee005f6534f279ed79b67c5f8c77a7fc07a30bc167d18b7e
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 4 IoCs
-
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.taobao.taobao1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.taobao.taobao/app_apkprotector_dex/classes-v1.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.taobao.taobao/app_apkprotector_dex/oat/x86/classes-v1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD537efde7b0227fb70ff38da0f5cd0d56c
SHA1a95c82e26f4c5d70ee01eb144b0d0172cda58665
SHA256665cef9155e10ffdd428dba9441f4b2d0e6fe549edfb45c6f0de15dc6535298b
SHA512ae5914137c6151efd1755094c59f47cb7e40ad3b06ae08a9be1ee1d2d8fce3fae034350588989bfa1120888604d39e8e6436e042443ccc3576b4af12840b94b8
-
Filesize
1.5MB
MD537efde7b0227fb70ff38da0f5cd0d56c
SHA1a95c82e26f4c5d70ee01eb144b0d0172cda58665
SHA256665cef9155e10ffdd428dba9441f4b2d0e6fe549edfb45c6f0de15dc6535298b
SHA512ae5914137c6151efd1755094c59f47cb7e40ad3b06ae08a9be1ee1d2d8fce3fae034350588989bfa1120888604d39e8e6436e042443ccc3576b4af12840b94b8
-
Filesize
1.5MB
MD55b9c9f9ca6fa65e7acc4686aeacbca98
SHA1c480aa42030e27581ed0a7fe1e12961a0df7c967
SHA2568de9a0568592c6fd7467a666ee1e006712d654e3f9342bd8bda6f2fa67b5430e
SHA512450f6a75a6538cafdd28b3cfc6b348ed4638a3072efa012ab8ec299670400ba0e74e16bf6edab720a1c1aeeddc630ea2183cc1931a16a0bf3d51612bd5e46d73
-
Filesize
1.5MB
MD537efde7b0227fb70ff38da0f5cd0d56c
SHA1a95c82e26f4c5d70ee01eb144b0d0172cda58665
SHA256665cef9155e10ffdd428dba9441f4b2d0e6fe549edfb45c6f0de15dc6535298b
SHA512ae5914137c6151efd1755094c59f47cb7e40ad3b06ae08a9be1ee1d2d8fce3fae034350588989bfa1120888604d39e8e6436e042443ccc3576b4af12840b94b8