Analysis
-
max time kernel
1843334s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
16-06-2022 18:53
General
-
Target
d62843e7064553f995bb97b3e064922ebc93ac6591112f9b58b11b51c5ca8b30.apk
-
Size
2.6MB
-
MD5
7aa3538e663b6f580f821a9b345ec187
-
SHA1
37470bd54c24ec5b42ee982bcd8df2f6255f3fa9
-
SHA256
d62843e7064553f995bb97b3e064922ebc93ac6591112f9b58b11b51c5ca8b30
-
SHA512
f9b7c1ade63343d92e93781fbb728fa354c58b210095da3f01a681cd6e3a038a84ae14e303e505c67a4944ebdac1497836671cbfba3ae0e6709c2a4abb0444eb
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload 2 IoCs
-
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.tencent.qqmusic1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD509970db0b5336a88d358583085cdda4a
SHA187526481cc5ba1ee8008b511dd4649a83e45e4a4
SHA256582df4768a5b6c7d25f36f9fda68e7224e773d7918e4034c88947ecb14376268
SHA512556d13bde1c4ca7d27f000151cfbe8370e09902417876ab1a5d99473c4da94bf9c7322ddef2b6394b279e820e88343765e1074e15ba04144a03dd55e7e69483b
-
Filesize
2.3MB
MD52f84073f750cce3b9c61df0a3a769ceb
SHA1b237b7305d30c408205b92188d3ecaa957301140
SHA2564e4249a1ebd84edcce0c22ace40dead606579eb44f23b0bbf4c45c93c01cc4cf
SHA51232f3d750c68c4e85f9e81f82c1a6232d66129843d437035cdf4eeafe5d90fcfd51f035d092e6bc266986b21eac083bf077dea4c2a69b0f495d77d199eef6348c
-
Filesize
307B
MD521fa0518341ac3172c3c1e6cd3a24a0f
SHA144ed4db7ee43d92212fa2c574b099420f04774d6
SHA2563358dcf76f577b0fe23667d346073b6ce8468301c17f0b5f36528f4d85398134
SHA512901731c19aa146dc71d51dff4ea9319bb7f1c4d1cb97318d30caba65193517fec649f8894e43e8755a086261018ffc4b731035ca327ecaa338789c40863144d5