Overview

overview

10

Static

static

7

139fca7c97...3e.apk

android_x86

10

139fca7c97...3e.apk

android_x64

10

139fca7c97...3e.apk

android_x64

10

Analysis

  • max time kernel
    1843231s
  • max time network
    163s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    16-06-2022 18:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    139fca7c979e272ff720feffcaf686aeb1dd25a6347d34bbaa443031982d5f3e.apk

  • Size

    6.8MB

  • MD5

    77c1fcc802753a77f042dc14863f9900

  • SHA1

    c56ec9ceafb44300acecaaf3a3049b64631ccd8f

  • SHA256

    139fca7c979e272ff720feffcaf686aeb1dd25a6347d34bbaa443031982d5f3e

  • SHA512

    0cf7d1e7c967210d027e1a945d2802e3baa458ca4cc77b3a1022890c005b627018cda5a226bf7185e742564707dff26503150d6c7faa935b60cdfb68141d4a81

Score
10/10
flubotbankerinfostealerransomwaresuricatatrojan

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

    bankertrojaninfostealerflubot
  • FluBot Payload 3 IoCs
  • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata
  • Makes use of the framework's Accessibility service. 1 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.tencent.mobileqq
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:5147
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mobileqq/app_DynamicOptDex/rib.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mobileqq/app_DynamicOptDex/oat/x86/rib.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:5251

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.tencent.mobileqq/app_DynamicOptDex/oat/rib.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.tencent.mobileqq/app_DynamicOptDex/oat/x86/rib.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.tencent.mobileqq/app_DynamicOptDex/oat/x86/rib.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.tencent.mobileqq/app_DynamicOptDex/rib.json
    Filesize

    3.1MB

    MD5

    048750ccea4e8472fdf66699916362fe

    SHA1

    4d9aed1259a2baecd95556a45cb922d68068b7e2

    SHA256

    8a7842ec65a1c14d3ecef7d0592542d532d0c018c28c0a5d14c82ab047615ad3

    SHA512

    4cbd447b17cd06205c8bc166a2ed201ee7d434bc74cf7d42170a9e6a05d706704321b3845ab4e8d22ae95f3279cd8d65f20d1f8b9403fc23932953b13b5ff636

    Download Submit

  • /data/user/0/com.tencent.mobileqq/app_DynamicOptDex/rib.json
    Filesize

    3.1MB

    MD5

    9ad1a7c23a995877e63fc07849e6ce91

    SHA1

    27745c40b203282cdbdf80ec62883cafec45b5d8

    SHA256

    967edfd07f7757b4d723198ad5daf2080d4f942a6d21c2159a90a22f1421d296

    SHA512

    e229cd318ee8a2a1cb0ca6b88270a7e8870d84ba9a267679fb739ba4b861a0777c960490e8fab616c9da1e6b4a6c83fab77fa5199f88f47d3df0e7f65f5e81c6

    Download Submit

  • /data/user/0/com.tencent.mobileqq/app_DynamicOptDex/rib.json
    Filesize

    3.1MB

    MD5

    20630f088b6f28a4dda717dbe5a92bb7

    SHA1

    77e82eecc2d930e95ec855ec76dd8dfc543f3eb3

    SHA256

    41cbe8f73478b0dea311e9773755c67bacd15228b27ba1a88e661a367057ba87

    SHA512

    a57d740db3c066e630086815e123f8dc21ab0046d1ccb427540211647b4bc238f52436884b5cd0dc6775ce3f0e50ddca7b3ba2f1d00972a4503ba1924a7dffe0

    Download Submit

  • /data/user/0/com.tencent.mobileqq/app_DynamicOptDex/rib.json
    Filesize

    3.1MB

    MD5

    9ad1a7c23a995877e63fc07849e6ce91

    SHA1

    27745c40b203282cdbdf80ec62883cafec45b5d8

    SHA256

    967edfd07f7757b4d723198ad5daf2080d4f942a6d21c2159a90a22f1421d296

    SHA512

    e229cd318ee8a2a1cb0ca6b88270a7e8870d84ba9a267679fb739ba4b861a0777c960490e8fab616c9da1e6b4a6c83fab77fa5199f88f47d3df0e7f65f5e81c6

    Download Submit

  • /data/user/0/com.tencent.mobileqq/app_DynamicOptDex/rib.json.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit