Analysis
-
max time kernel
1842818s -
max time network
158s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
16-06-2022 18:44
General
-
Target
1dc84f5f1ee6daf33f5da0d0d82f252c64274a771c6214170eae441d18447fea.apk
-
Size
4.8MB
-
MD5
d086e98cc813dc57c3b2b9a299ae2928
-
SHA1
94078ef7ca8fbecd5194f082902ca991650e29e7
-
SHA256
1dc84f5f1ee6daf33f5da0d0d82f252c64274a771c6214170eae441d18447fea
-
SHA512
dfccb95a17e570225938bfa82d6a9d8c1f22e172e45c8a357b3a05d64ba670d372d69d38e92d9250191f10db454a2246d2ab5877fb759ee0bd2bd33b199a16cc
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 2 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.baidu.searchbox1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.baidu.searchbox/U78jGk8gGI/jgdigj9jwkh786g/base.apk.IGtktGg1.Ide --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.baidu.searchbox/U78jGk8gGI/jgdigj9jwkh786g/oat/x86/base.apk.IGtktGg1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5276dda73a33e26b92a856aee64bab6f6
SHA139594ad2317acae957af97aa710ef870e6bc7ee7
SHA25609d188a7bc9be9d161c96fe13890c94a451645067a6d34fb0fca6d6e0390eaa2
SHA512d80937e9acc83d5b56e8fc377b36f96b8c56af1da08b6fde7a1fa25430df5e395d363bcc64eeb418ee3d9ceacfb085a5063cced4f2192b66bb9ac670f80926d0
-
Filesize
2.0MB
MD5276dda73a33e26b92a856aee64bab6f6
SHA139594ad2317acae957af97aa710ef870e6bc7ee7
SHA25609d188a7bc9be9d161c96fe13890c94a451645067a6d34fb0fca6d6e0390eaa2
SHA512d80937e9acc83d5b56e8fc377b36f96b8c56af1da08b6fde7a1fa25430df5e395d363bcc64eeb418ee3d9ceacfb085a5063cced4f2192b66bb9ac670f80926d0