Overview

overview

10

Static

static

7

fedex.apk

android-9-x86

10

fedex.apk

android-10-x64

10

fedex.apk

android-11-x64

10

Analysis

  • max time kernel
    381305s
  • max time network
    610s
  • platform
    android_x64
  • resource
    android-x64-20220823-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
  • submitted
    26-10-2022 23:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fedex.apk

  • Size

    4.0MB

  • MD5

    2ffac6c6ba63598b34dc8a076208f7b4

  • SHA1

    02d20c723835a961b594ada5c5acff8ee5ed9bab

  • SHA256

    2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c

  • SHA512

    fbb2955d883d9275bfa0f7c23ca1110ceed1b13083ec249f8445c9c203fdbd9554c36ab91b7c3634871812f3661a7a0b33dc4168b2ef0f1afcff26e370468bd8

  • SSDEEP

    98304:+1iNL19D17KA443+dt+G9ZDPAC77jZRFJhYv09Lc:7NLLZ7l4F2+97j7FJ/Lc

Score
10/10
flubotbankerdiscoveryinfostealerransomwaretrojan

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

    bankertrojaninfostealerflubot
  • FluBot payload 3 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.tencent.mm
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4711

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin
    Filesize

    3.1MB

    MD5

    aca8ab11deeeed62a960d35ffa984401

    SHA1

    a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

    SHA256

    45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

    SHA512

    c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

    Download Submit

  • /data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin
    Filesize

    3.1MB

    MD5

    aca8ab11deeeed62a960d35ffa984401

    SHA1

    a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

    SHA256

    45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

    SHA512

    c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

    Download Submit

  • /data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin
    Filesize

    3.1MB

    MD5

    aca8ab11deeeed62a960d35ffa984401

    SHA1

    a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

    SHA256

    45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

    SHA512

    c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

    Download Submit

  • /data/user/0/com.tencent.mm/shared_prefs/FedEx.xml
    Filesize

    133B

    MD5

    a8836451b072cfe3204a1c6e29f59013

    SHA1

    e06087ba476fe44443ec122f6741073db432c21e

    SHA256

    64e356231b6246a9184799c399bbbfeb86e19c15100831d3d068547861ea82aa

    SHA512

    afb685dcacf6e7dc2cdc1e2a437c48b106786aa920aa565f821a64a656fcd56f9838e7b72d7b6ccdcc4e5202eec73e67573451335f16ba663b87c39f9b95c414

    Download Submit

  • /data/user/0/com.tencent.mm/shared_prefs/FedEx.xml
    Filesize

    197B

    MD5

    02fdf3b7cf0b0f8bc34a84e3922f4c3b

    SHA1

    b81caaf1724b8f23721c3f45558a7093d46c1178

    SHA256

    e44f0fff7c40fa56fa2f060d47c56f4460270b3356a7f706583bc0f4a4773fb7

    SHA512

    c837341fcebe063404d77638481036c7c49756059522da291110138b534535737d84a4a9258e7697f2df3169dc9502efcd879d995b2d5a4355d0a47d8807ac0f

    Download Submit