General

  • Target

    d62843e7064553f995bb97b3e064922ebc93ac6591112f9b58b11b51c5ca8b30.apk

  • Size

    2.6MB

  • Sample

    220616-xjmnasbbh3

  • MD5

    7aa3538e663b6f580f821a9b345ec187

  • SHA1

    37470bd54c24ec5b42ee982bcd8df2f6255f3fa9

  • SHA256

    d62843e7064553f995bb97b3e064922ebc93ac6591112f9b58b11b51c5ca8b30

  • SHA512

    f9b7c1ade63343d92e93781fbb728fa354c58b210095da3f01a681cd6e3a038a84ae14e303e505c67a4944ebdac1497836671cbfba3ae0e6709c2a4abb0444eb

Malware Config

Targets

    • Target

      d62843e7064553f995bb97b3e064922ebc93ac6591112f9b58b11b51c5ca8b30.apk

    • Size

      2.6MB

    • MD5

      7aa3538e663b6f580f821a9b345ec187

    • SHA1

      37470bd54c24ec5b42ee982bcd8df2f6255f3fa9

    • SHA256

      d62843e7064553f995bb97b3e064922ebc93ac6591112f9b58b11b51c5ca8b30

    • SHA512

      f9b7c1ade63343d92e93781fbb728fa354c58b210095da3f01a681cd6e3a038a84ae14e303e505c67a4944ebdac1497836671cbfba3ae0e6709c2a4abb0444eb

    • FluBot

      FluBot is an android banking trojan that uses overlays.

    • FluBot Payload

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Enterprise v6

Tasks