Analysis
-
max time kernel
380478s -
max time network
46s -
platform
android_x64 -
resource
android-x64-arm64-20220823-en -
resource tags
-
submitted
26-10-2022 23:31
General
-
Target
78d6dc4d6388e1a92a5543b80c038ac66430c7cab3b877eeb0a834bce5cb7c25.apk
-
Size
4.8MB
-
MD5
23d92d04a25f2bfea3d2f147cd79be8e
-
SHA1
956308322bd9d64e9258986d9c5f64439a2c23a3
-
SHA256
78d6dc4d6388e1a92a5543b80c038ac66430c7cab3b877eeb0a834bce5cb7c25
-
SHA512
3dcd00d0eeed37f3a912922146cc867de568545ac721257d405154fb05628793f8fa13f340ece6c70a4dd982e95ba53a8b5a83dd17e98cc17be156a7839c17b2
-
SSDEEP
98304:y4zbjHHYuxJ8GfFaqFGYrVPl7ybvuGP3IpwK98g8ovvSWWZiW:yq3Yuxy4LGYRdun3IpwoV5qWWL
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.snda.wifilocating1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD588b801e20e638b2477b2afeb558d1f12
SHA13899575ed8d71e86a138018551e3517b06b318b6
SHA256298a2c754226c4c631c718c436be8d352037a85499b754b5a89865b6c40854b6
SHA51234a5bacb591332049242de85c34aae63f923fe87e4e27de2fb8a92db5a29d5726ade581bb08015ccc8169545484c8a9fc6ccedf104fe581f4b8291d0c8eb10cb
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
133B
MD5dd2ed6d860e9bf205dd3c661e7df5ed5
SHA1dad875c129b14bf526164e730323fde0bdc3a16f
SHA256561fdade5928773bf0b521d8b12db567f1a5797a0463c1b03779f78d1ebb5a77
SHA51237136221d862925d7bba712c6e2f835450aa5907201ec305b4c64284622d7846f4c435de40624014d27b94c28a24d9bff0214e98c633c412a42b42d452778b74
-
Filesize
197B
MD5744a324cd3c1a2113905e3348cb9b819
SHA1c21f71347cedd272f2f84648a0e1ef3992311148
SHA256ce351574ab1d66d971c99ad4af457f1623a47bb71b7aa91d88261df12a4b583d
SHA512e34c3f293797177b44887e5eb08e6da0dda6ee164aa48cd1595e0a3a5bf952f071bf962358119764865347f029f546adf02248b3cfb3834d3c82aaf775efa72b