General

  • Target

    b711fce602d19f10c34650842f610eeefb848e0d12e69d040db45bec67652bf6.apk

  • Size

    3.1MB

  • Sample

    220616-xcen4sgfdp

  • MD5

    a7c8ad14f45770ee7890ebcf327a85f3

  • SHA1

    5891fe3d91d2e9c7ad4141b54776ca86d0650218

  • SHA256

    b711fce602d19f10c34650842f610eeefb848e0d12e69d040db45bec67652bf6

  • SHA512

    1716278f58fc0705f7ec432321a6e06ff17ab3e4e9c487f15f27093df9fed8b20c02334b47a44943b343f23aabc2c1393db0b016d7a3f012f26b984b717e3d2d

Malware Config

Targets

    • Target

      b711fce602d19f10c34650842f610eeefb848e0d12e69d040db45bec67652bf6.apk

    • Size

      3.1MB

    • MD5

      a7c8ad14f45770ee7890ebcf327a85f3

    • SHA1

      5891fe3d91d2e9c7ad4141b54776ca86d0650218

    • SHA256

      b711fce602d19f10c34650842f610eeefb848e0d12e69d040db45bec67652bf6

    • SHA512

      1716278f58fc0705f7ec432321a6e06ff17ab3e4e9c487f15f27093df9fed8b20c02334b47a44943b343f23aabc2c1393db0b016d7a3f012f26b984b717e3d2d

    • FluBot

      FluBot is an android banking trojan that uses overlays.

    • FluBot Payload

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Enterprise v6

Tasks