Analysis
-
max time kernel
1842776s -
max time network
166s -
platform
android_x64 -
resource
android-x64-20220310-en -
submitted
16-06-2022 18:43
General
-
Target
e93a4e8bec4e2bf47157e55be150c8fb62c38cd4ca180b473f53259fa44cdd48.apk
-
Size
4.2MB
-
MD5
58fe07645a418f93efeeeacb04dd16c0
-
SHA1
62a5e53b179e4b6b66f8094db788afd2e3eb550f
-
SHA256
e93a4e8bec4e2bf47157e55be150c8fb62c38cd4ca180b473f53259fa44cdd48
-
SHA512
2b358681bc4429b34d5777f9f778a056addfd26d0497a9a5282ead8f83cbb2845b292b3fbbd4096925b39d0dd08103d586afff7b6e7a183d5f34c8ac31a44e11
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 1 IoCs
-
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.qiyi.video1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5dd62e312a1d44d6a0fa4aceeef1816be
SHA1e95f766465f9422c368d396abf0a71d3e89f9acc
SHA25663d31005d25172a341177dff397fb50469fe0434a8966eb73bc57eb7b6e60883
SHA512c92d50a6db6da41cb94747f10d1426407268033ded04aab920efdc00aa334fe1680d5dcb6c00b007d8a12a2afccd7b990c64bc940fde634809ee3a668651d608
-
Filesize
305B
MD5dac9ad07f4fbba2da4be90dca77f7380
SHA14ad2b26fa2ad390872fb82c2e80dbfe5e91d5447
SHA2566c86b0ca4ed08372b026d3a507e65a659ad79409f610ecc7a480f24ee5182354
SHA51281218f8afceb3199c91cc8b19f27ae3e1b1515d9692bdcb287bc20aa9595d385da07f292bb9bdf37f48ee1bf388ade9791a40c80d1cdaedb011afb945e8eb555