Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

Malware.unknown.apk

android-9-x86

10

Malware.unknown.apk

android-10-x64

10

Malware.unknown.apk

android-11-x64

10

Resubmissions

07/02/2023, 12:04

230207-n8lymaef8v 10

07/02/2023, 12:03

230207-n71emaef71 10

Analysis

  • max time kernel
    730761s
  • max time network
    159s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    07/02/2023, 12:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Malware.unknown.apk

  • Size

    3.0MB

  • MD5

    75c0eb2c78ff31534a588ec47088b622

  • SHA1

    abc703f6e5b824d0a1c14108228009001509a162

  • SHA256

    0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23

  • SHA512

    d0b74f972f851fc7a1f715e152e6f439a080b4d7b1f3129cec6c3164d8b1f75c34a920c393d5d05be45185a2b926b6c382b5e83387436b7905b2500e3db4c36b

  • SSDEEP

    49152:Y09ypryDHH0D6gmPOroTV8asMbUCNhSBNwj0ciNcJ3W7HxTQqUonX73lwp:YXrWn0DAOroTV87w4kjD09RzUsyp

Score
10/10
flubotbankerdiscoveryevasioninfostealertrojan

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

    bankertrojaninfostealerflubot
  • FluBot payload 4 IoCs
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Removes a system notification. 1 IoCs
    evasion

Processes

  • com.xunmeng.pinduoduo
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    PID:4115
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4172

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king
    Filesize

    2.4MB

    MD5

    5b49441a9350dd3b4dba093b8faa2c8e

    SHA1

    bbe36075bd706b87eb7f96fc498c83088b717226

    SHA256

    c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

    SHA512

    e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

    Download Submit

  • /data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king
    Filesize

    2.4MB

    MD5

    5b49441a9350dd3b4dba093b8faa2c8e

    SHA1

    bbe36075bd706b87eb7f96fc498c83088b717226

    SHA256

    c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

    SHA512

    e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

    Download Submit

  • /data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king
    Filesize

    2.4MB

    MD5

    3295dbeea222279d227a2c3cab5d99ca

    SHA1

    a8cdf90f561932d3c4d731df6bf659229488167b

    SHA256

    c6c265e23b50e5375c9e67b27da8bb36ada0f10840a2881720ef4f3314abd6f8

    SHA512

    27a15346ee73a817fcbcf6a80c4c576e91b74d2f0141a11fe11a5be8cd94482e3597a54e0277475b420702ca064d02422bff3adc9d702215a8f59a1d01ffea00

    Download Submit

  • /data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king
    Filesize

    2.4MB

    MD5

    5b49441a9350dd3b4dba093b8faa2c8e

    SHA1

    bbe36075bd706b87eb7f96fc498c83088b717226

    SHA256

    c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

    SHA512

    e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

    Download Submit

  • /data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml
    Filesize

    133B

    MD5

    bf29ea1bb1537965b21b511cba4bb9a4

    SHA1

    d959721db05bfd092d656b7c4e51827673c0f5a4

    SHA256

    6fc602fc9004a4612db9d14e56e1891c35426ba2571c6913bcedef3f35708efb

    SHA512

    92be10009d9b4f86c23c81f4df0983166eb35e8df4d84106107de842146f0b4a6bc8758a0c66cd0d3dbf33807841d0535b71912350a24e713891ed84c37caa56

    Download Submit

  • /data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml
    Filesize

    197B

    MD5

    f592a3e486a227179cd42d16d203cf58

    SHA1

    6210c33304c8ddaf8832a8e7fbaccc4ef6d987c8

    SHA256

    ca10bdd4ef62947dcabe9a148265785312af218403b16da40b19f53a3a339a4c

    SHA512

    ee9897c170ac361e53885172737934562f1f61b0a107592dc9879bebb576751a17732ee91d17415e92fc4f318070de7d1c011c669ea81cddb34fd62662f92169

    Download Submit