Analysis
-
max time kernel
1842871s -
max time network
151s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
16-06-2022 18:46
General
-
Target
eb446a816c77cab326d2fe91fb9b3dd3e5be21e0eb0e4eb35fbdebcdc8d56d35_unpacked.apk
-
Size
4.0MB
-
MD5
2ffac6c6ba63598b34dc8a076208f7b4
-
SHA1
02d20c723835a961b594ada5c5acff8ee5ed9bab
-
SHA256
2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c
-
SHA512
fbb2955d883d9275bfa0f7c23ca1110ceed1b13083ec249f8445c9c203fdbd9554c36ab91b7c3634871812f3661a7a0b33dc4168b2ef0f1afcff26e370468bd8
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 4 IoCs
-
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_apkprotector_dex/oat/x86/classes-v1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5aca8ab11deeeed62a960d35ffa984401
SHA1a20fc21166d30e80f0f8cfcd3ce7c7a11b579960
SHA25645b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf
SHA512c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8
-
Filesize
3.1MB
MD5aca8ab11deeeed62a960d35ffa984401
SHA1a20fc21166d30e80f0f8cfcd3ce7c7a11b579960
SHA25645b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf
SHA512c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8
-
Filesize
3.1MB
MD5be4a01c50b0abbabbdcbb8b549f43a2a
SHA1c50a9b8ae100bdf1698852e0e5ac5ed3976c752d
SHA25624779aa5e7b19568d23938c0cecb74cce7f08dd7190ff602d788af241409a1b4
SHA512baafabf7b1261f0767bf0f87d411e470c758db7a243668ac00f45ae315158a239b07bc24849ad04de62034a5f6da0eeddaf93c1621bb31d2d34047d9cad82274
-
Filesize
3.1MB
MD5aca8ab11deeeed62a960d35ffa984401
SHA1a20fc21166d30e80f0f8cfcd3ce7c7a11b579960
SHA25645b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf
SHA512c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8