Analysis
-
max time kernel
1842779s -
max time network
170s -
platform
android_x64 -
resource
android-x64-arm64-20220310-en -
submitted
16-06-2022 18:43
General
-
Target
e93a4e8bec4e2bf47157e55be150c8fb62c38cd4ca180b473f53259fa44cdd48.apk
-
Size
4.2MB
-
MD5
58fe07645a418f93efeeeacb04dd16c0
-
SHA1
62a5e53b179e4b6b66f8094db788afd2e3eb550f
-
SHA256
e93a4e8bec4e2bf47157e55be150c8fb62c38cd4ca180b473f53259fa44cdd48
-
SHA512
2b358681bc4429b34d5777f9f778a056addfd26d0497a9a5282ead8f83cbb2845b292b3fbbd4096925b39d0dd08103d586afff7b6e7a183d5f34c8ac31a44e11
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 1 IoCs
-
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.qiyi.video1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5dd62e312a1d44d6a0fa4aceeef1816be
SHA1e95f766465f9422c368d396abf0a71d3e89f9acc
SHA25663d31005d25172a341177dff397fb50469fe0434a8966eb73bc57eb7b6e60883
SHA512c92d50a6db6da41cb94747f10d1426407268033ded04aab920efdc00aa334fe1680d5dcb6c00b007d8a12a2afccd7b990c64bc940fde634809ee3a668651d608
-
Filesize
305B
MD5fe1585c9dfe7f5929b43713939884694
SHA166a1252831bf3d5c188a30c01e711d16287cd167
SHA2562e28b4cf651c5beac9ed334b9278aba1bb657cc0c5326ce13a5c3cff1822db06
SHA512b17f5b30cfc5ebc4e82f9b4711cfbc366ebc1d13975dad71a65a574a7548325a73a3ae7674b442826bc8b05fbdd2eb540755ab2e82330bf0056409660ea03dcf