Analysis
-
max time kernel
3671517s -
max time network
158s -
platform
android_x64 -
resource
android-x64-arm64-20220621-en -
submitted
07-07-2022 22:03
General
-
Target
43b393b37cb1c99d67812f7bf0fb266536929bb44e03c0fd26448e50689be842.apk
-
Size
4.6MB
-
MD5
e217d5f901d965a9571cc0e0f37acf8b
-
SHA1
8a69948f3be45c2d7f3d26f98a55f5440e0f661e
-
SHA256
43b393b37cb1c99d67812f7bf0fb266536929bb44e03c0fd26448e50689be842
-
SHA512
5d3853d4ee21b915dbb5713c2538ba4e53409247899afd95130502cd2810e873981c12e22d9ab2a5d9d7190bb5804b373c9c1d7d20fae822c8ddb9342faf19c5
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.snda.wifilocating1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5bac0be3bb0abbf42ade3ea9c3645d2f5
SHA1a6e71f718c564f8607dd1323fb79bd15be1de2f9
SHA2565c3816dd64976f5507dca90fdbcd5f93939732c54d9ddf0e1f2b51acbba68f72
SHA5129b4d730845e6d2069f75d10d68326d36d3c66b79299baf5a35956e5afa779ff336a555126a200321354f86b36462044d1d0ca8d5a077fe560e72fa2a57eefcd0