Overview

overview

10

Static

static

7

Malware.unknown.apk

android-9-x86

10

Malware.unknown.apk

android-10-x64

10

Malware.unknown.apk

android-11-x64

10

Resubmissions

07/02/2023, 12:04

230207-n8lymaef8v10

07/02/2023, 12:03

230207-n71emaef7110

Analysis

  • max time kernel
    734334s
  • max time network
    170s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    07/02/2023, 12:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Malware.unknown.apk
  • Size 3.0MB
  • Sample230207-n71emaef71
  • SHA256 0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
flubotbankerevasioninfostealertrojan

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

    bankertrojaninfostealerflubot
  • FluBot payload 3 IoCs
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings. 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Removes a system notification. 1 IoCs
    evasion

Processes

  • com.xunmeng.pinduoduo
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    • Requests enabling of the accessibility settings.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    PID:4278

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        xCSswjlO.king
        • Path /data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king
        • Size 2.4MB
        • SHA256 c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        xCSswjlO.king
        • Path /data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king
        • Size 2.4MB
        • SHA256 c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d
        • MD5 SHA1 SHA512 SSDEEP
        Download

        xCSswjlO.king
        • Path /data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king
        • Size 2.4MB
        • SHA256 c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d
        • MD5 SHA1 SHA512 SSDEEP
        Download

        Voicemail.xml
        • Path /data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml
        • Size 133B
        • SHA256 d27dc42975c31fafce26c0e1c2f4a4d997fb857c1bb4a92aeaa8758182da12ee
        • MD5 SHA1 SHA512
        Submit Download

        Voicemail.xml
        • Path /data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml
        • Size 197B
        • SHA256 5277d932875c184382b036b9498843783d56789438d5df7c7b2175f1da62e466
        • MD5 SHA1 SHA512
        Submit Download