Analysis

  • max time kernel
    1842737s
  • max time network
    171s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220310-en
  • submitted
    16-06-2022 18:42

General

  • Target

    4da397dcda35bd469b3af3c0f49ef7a2a4e19e3338f2b557560384d174b197fa.apk

  • Size

    6.7MB

  • MD5

    528e717abda498c72a11370631410cad

  • SHA1

    3a41286bdc3becf2f6eb6403c71ff4cce5dd6b0d

  • SHA256

    4da397dcda35bd469b3af3c0f49ef7a2a4e19e3338f2b557560384d174b197fa

  • SHA512

    0e054e89e39fa004580575002f6df4e484cc69bf5be6eabb968acd9d854ce34e77e3fb1aa47ef6c314885667d0419ac8c656af0bee5f64dd3872be8062a14e24

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

  • FluBot Payload 2 IoCs
  • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

  • Makes use of the framework's Accessibility service. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.tencent.mobileqq
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:7049

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.tencent.mobileqq/app_DynamicOptDex/oBN.json

    Filesize

    3.1MB

    MD5

    50dd5aa3d270400f2a8b5ae821bc0146

    SHA1

    eff69432d8b2e72be0bb035b0d9f99abfd47680e

    SHA256

    c23e1e9350074d07bdd4478851401a53bff1acccb762a50f7e6fc6f9c8e5bb12

    SHA512

    99584f250854cdffbbce1890fec38b7a36716556983c11f5566ffbef885614a74b97f74b11da0aabf01160157b7a580aea5261f09b44e4f991026c3e3b623afa

  • /data/user/0/com.tencent.mobileqq/app_DynamicOptDex/oBN.json

    Filesize

    3.1MB

    MD5

    ad8465c129549af17e79674174d034f0

    SHA1

    68d7f89e3f976b5ad66fcf9eb9b881259a41c8fb

    SHA256

    41dd1e6416de4f990cfbc24ad3d9dc6bf830d2028adff42202bc5587fbf4c668

    SHA512

    84f87c7f23c9e73d342ef5aca9bacf25dcce00d1b76c38d01b2678cf72c82689a62e41adfc77060d80e170ea8aece7022bc407c5f38065c7f4873f14de9df29e

  • /data/user/0/com.tencent.mobileqq/app_DynamicOptDex/oBN.json

    Filesize

    3.1MB

    MD5

    ad8465c129549af17e79674174d034f0

    SHA1

    68d7f89e3f976b5ad66fcf9eb9b881259a41c8fb

    SHA256

    41dd1e6416de4f990cfbc24ad3d9dc6bf830d2028adff42202bc5587fbf4c668

    SHA512

    84f87c7f23c9e73d342ef5aca9bacf25dcce00d1b76c38d01b2678cf72c82689a62e41adfc77060d80e170ea8aece7022bc407c5f38065c7f4873f14de9df29e