Overview

overview

10

Static

static

7

0de7ded6e4...23.apk

android_x86

10

0de7ded6e4...23.apk

android_x64

10

0de7ded6e4...23.apk

android_x64

1

Analysis

  • max time kernel
    2747175s
  • max time network
    161s
  • platform
    android_x64
  • resource
    android-x64-20220621-en
  • submitted
    27-06-2022 05:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23.apk

  • Size

    3.0MB

  • MD5

    75c0eb2c78ff31534a588ec47088b622

  • SHA1

    abc703f6e5b824d0a1c14108228009001509a162

  • SHA256

    0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23

  • SHA512

    d0b74f972f851fc7a1f715e152e6f439a080b4d7b1f3129cec6c3164d8b1f75c34a920c393d5d05be45185a2b926b6c382b5e83387436b7905b2500e3db4c36b

Score
10/10
flubotbankerdiscoveryinfostealerransomwaresuricatatrojan

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

    bankertrojaninfostealerflubot
  • FluBot Payload 3 IoCs
  • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.xunmeng.pinduoduo
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:6176

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king
    Filesize

    2.4MB

    MD5

    5b49441a9350dd3b4dba093b8faa2c8e

    SHA1

    bbe36075bd706b87eb7f96fc498c83088b717226

    SHA256

    c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

    SHA512

    e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

    Download Submit

  • /data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king
    Filesize

    2.4MB

    MD5

    5b49441a9350dd3b4dba093b8faa2c8e

    SHA1

    bbe36075bd706b87eb7f96fc498c83088b717226

    SHA256

    c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

    SHA512

    e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

    Download Submit

  • /data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king
    Filesize

    2.4MB

    MD5

    5b49441a9350dd3b4dba093b8faa2c8e

    SHA1

    bbe36075bd706b87eb7f96fc498c83088b717226

    SHA256

    c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

    SHA512

    e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

    Download Submit