Analysis
-
max time kernel
4062877s -
max time network
129s -
platform
android_x86 -
resource
android-x86-arm-20220621-en -
submitted
12-07-2022 11:07
General
-
Target
flubot_fe52bed001f28a4b218bcd0ad31b92fb59022778cf68a1445cf3e8c612a5e04c.apk
-
Size
4.2MB
-
MD5
37be18494cd03ea70a1fdd6270cef6e3
-
SHA1
4714aaa5195da29c6e74aeee9e9f19678af5c15b
-
SHA256
fe52bed001f28a4b218bcd0ad31b92fb59022778cf68a1445cf3e8c612a5e04c
-
SHA512
5452d2e545c46b94d3209b332fea6e87727039371688e2ae63ad303c014db5e7b5d4222d4dcefd703fc4a4f15e6f685ec5e62cabe396573bed0e0f78a40d679f
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 4 IoCs
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.tencent.mobileqq1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/oat/x86/ISM4bLeG.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.5MB
MD54f3fd634a3822ebc963297b1c6e02f62
SHA1c7dba2509d53b8b3ad9b526b9e46ad32db3f1eab
SHA2566c0bd313d36ac2d0180a8ccd6d7416fc7f0f56781e00128af6a67772d46707d6
SHA5126f58bc4a947e1533df435e6b7f5f9380f022e821e596fbc7939f99a9f63fda73e3b5869834a6b994c421db8ac5f15859e78ab57274ddb009e952688cd5106b41
-
Filesize
6.5MB
MD54f3fd634a3822ebc963297b1c6e02f62
SHA1c7dba2509d53b8b3ad9b526b9e46ad32db3f1eab
SHA2566c0bd313d36ac2d0180a8ccd6d7416fc7f0f56781e00128af6a67772d46707d6
SHA5126f58bc4a947e1533df435e6b7f5f9380f022e821e596fbc7939f99a9f63fda73e3b5869834a6b994c421db8ac5f15859e78ab57274ddb009e952688cd5106b41
-
Filesize
6.5MB
MD57e8a1b2ded831ab9a677c449a4fec501
SHA1616c8e9c6ad97e088fcd65a04f2642d10e38a417
SHA25617f6f1158d41bdf5a33e839053b323b5215a5f7f51598f6768f39f338c59665e
SHA512bb6da7444685ad5348777163c6086bfd5e132e37df83ed42a8aa9294f01a0baf6112ee2810a5c84db44929f0b0e92e69f2c49afe1b530e1e1d772c4d1edd6906
-
Filesize
6.5MB
MD54f3fd634a3822ebc963297b1c6e02f62
SHA1c7dba2509d53b8b3ad9b526b9e46ad32db3f1eab
SHA2566c0bd313d36ac2d0180a8ccd6d7416fc7f0f56781e00128af6a67772d46707d6
SHA5126f58bc4a947e1533df435e6b7f5f9380f022e821e596fbc7939f99a9f63fda73e3b5869834a6b994c421db8ac5f15859e78ab57274ddb009e952688cd5106b41
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e