Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
730761s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
07/02/2023, 12:04
Static task
static1
Behavioral task
behavioral1
Sample
Malware.unknown.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
Malware.unknown.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral3
Sample
Malware.unknown.apk
Resource
android-x64-arm64-20220823-en
General
-
Target
Malware.unknown.apk
-
Size
3.0MB
-
MD5
75c0eb2c78ff31534a588ec47088b622
-
SHA1
abc703f6e5b824d0a1c14108228009001509a162
-
SHA256
0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23
-
SHA512
d0b74f972f851fc7a1f715e152e6f439a080b4d7b1f3129cec6c3164d8b1f75c34a920c393d5d05be45185a2b926b6c382b5e83387436b7905b2500e3db4c36b
-
SSDEEP
49152:Y09ypryDHH0D6gmPOroTV8asMbUCNhSBNwj0ciNcJ3W7HxTQqUonX73lwp:YXrWn0DAOroTV87w4kjD09RzUsyp
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 4 IoCs
resource yara_rule behavioral1/files/4115-0.dat family_flubot behavioral1/memory/4115-0.dex family_flubot behavioral1/memory/4172-0.dex family_flubot behavioral1/memory/4115-1.dex family_flubot -
Makes use of the framework's Accessibility service. 3 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.xunmeng.pinduoduo Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.xunmeng.pinduoduo Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.xunmeng.pinduoduo -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king 4115 com.xunmeng.pinduoduo /data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king 4172 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king 4115 com.xunmeng.pinduoduo -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Removes a system notification. 1 IoCs
description ioc Process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.xunmeng.pinduoduo
Processes
-
com.xunmeng.pinduoduo1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4115 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4172
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD55b49441a9350dd3b4dba093b8faa2c8e
SHA1bbe36075bd706b87eb7f96fc498c83088b717226
SHA256c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d
SHA512e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94
-
Filesize
2.4MB
MD55b49441a9350dd3b4dba093b8faa2c8e
SHA1bbe36075bd706b87eb7f96fc498c83088b717226
SHA256c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d
SHA512e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94
-
Filesize
2.4MB
MD53295dbeea222279d227a2c3cab5d99ca
SHA1a8cdf90f561932d3c4d731df6bf659229488167b
SHA256c6c265e23b50e5375c9e67b27da8bb36ada0f10840a2881720ef4f3314abd6f8
SHA51227a15346ee73a817fcbcf6a80c4c576e91b74d2f0141a11fe11a5be8cd94482e3597a54e0277475b420702ca064d02422bff3adc9d702215a8f59a1d01ffea00
-
Filesize
2.4MB
MD55b49441a9350dd3b4dba093b8faa2c8e
SHA1bbe36075bd706b87eb7f96fc498c83088b717226
SHA256c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d
SHA512e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94
-
Filesize
133B
MD5bf29ea1bb1537965b21b511cba4bb9a4
SHA1d959721db05bfd092d656b7c4e51827673c0f5a4
SHA2566fc602fc9004a4612db9d14e56e1891c35426ba2571c6913bcedef3f35708efb
SHA51292be10009d9b4f86c23c81f4df0983166eb35e8df4d84106107de842146f0b4a6bc8758a0c66cd0d3dbf33807841d0535b71912350a24e713891ed84c37caa56
-
Filesize
197B
MD5f592a3e486a227179cd42d16d203cf58
SHA16210c33304c8ddaf8832a8e7fbaccc4ef6d987c8
SHA256ca10bdd4ef62947dcabe9a148265785312af218403b16da40b19f53a3a339a4c
SHA512ee9897c170ac361e53885172737934562f1f61b0a107592dc9879bebb576751a17732ee91d17415e92fc4f318070de7d1c011c669ea81cddb34fd62662f92169