Analysis

  • max time kernel
    2927688s
  • max time network
    168s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    12-06-2023 07:25

General

  • Target

    base.apk

  • Size

    3.3MB

  • MD5

    15328ea6d31bef8ddd15a81e0f5a549b

  • SHA1

    c52f12651d91a9bf0d625a879b34d194eba69ed4

  • SHA256

    a778818cc08d213d1f66db5fa8b34aabc862569ecb99fd1aea37ff6ccab48400

  • SHA512

    5939a527d289315ff6d354bbd6e834ae9b3f452aebc54114a0fb46cb5422e5537ff0592aa62fbd20d753162f6a3ae56cfd97c4320613d1377a9b5a7d6a525336

  • SSDEEP

    49152:qLzu436uB6iejEyNRe1kqqGI18iNwDelhcTUr4T1S0NwBbGJ3H5+ELr42SKn2IQI:qHuKB6BzReWqqGWNN8g4ETBaJ7n2Izl

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

  • FluBot payload 3 IoCs
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings. 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Removes a system notification. 1 IoCs

Processes

  • com.sina.weibo
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    • Requests enabling of the accessibility settings.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    PID:4516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.sina.weibo/app_apkprotector_dex/Zw6IGlco.ppt

    Filesize

    2.3MB

    MD5

    44e5099c255320beb84c347c28d9ffba

    SHA1

    32bccc9ebf25868ac299f14f45da44e166f424f1

    SHA256

    51a29d7ced99b68bf97e8dfff99f3a99aa157c7e6f86161e83935f750c5c73d3

    SHA512

    4efcbd07e80007e6b2c178c203a218cdcdba2c58347010485148e237aa4bc4b6a8c9aa2b53a9907b430349a1643e5e262e4049541dbab09a171b4f0ce73a9d88

  • /data/user/0/com.sina.weibo/app_apkprotector_dex/Zw6IGlco.ppt

    Filesize

    2.3MB

    MD5

    44e5099c255320beb84c347c28d9ffba

    SHA1

    32bccc9ebf25868ac299f14f45da44e166f424f1

    SHA256

    51a29d7ced99b68bf97e8dfff99f3a99aa157c7e6f86161e83935f750c5c73d3

    SHA512

    4efcbd07e80007e6b2c178c203a218cdcdba2c58347010485148e237aa4bc4b6a8c9aa2b53a9907b430349a1643e5e262e4049541dbab09a171b4f0ce73a9d88

  • /data/user/0/com.sina.weibo/app_apkprotector_dex/Zw6IGlco.ppt

    Filesize

    2.3MB

    MD5

    44e5099c255320beb84c347c28d9ffba

    SHA1

    32bccc9ebf25868ac299f14f45da44e166f424f1

    SHA256

    51a29d7ced99b68bf97e8dfff99f3a99aa157c7e6f86161e83935f750c5c73d3

    SHA512

    4efcbd07e80007e6b2c178c203a218cdcdba2c58347010485148e237aa4bc4b6a8c9aa2b53a9907b430349a1643e5e262e4049541dbab09a171b4f0ce73a9d88

  • /data/user/0/com.sina.weibo/shared_prefs/Voicemail.xml

    Filesize

    133B

    MD5

    77c774857cada47f95e5ee64d62cfb27

    SHA1

    e31c8864f56c037cf8e9bb7ee8eee6a28b8d15dc

    SHA256

    da8fc6118562e0a46692b12b45fff5281541e1900a95dfc04a7089a19a5da1e2

    SHA512

    a9c8469ea8ddafcd5e1b2819f7509e257efcaf5d346833a86b22ff52cd3855496f48855d78b1a84d8cb17b3fddefb548e364cf81c963545b17f14f26ba42b65f

  • /data/user/0/com.sina.weibo/shared_prefs/Voicemail.xml

    Filesize

    197B

    MD5

    2205070cd66cc2c94bc6116cad6a3472

    SHA1

    369b9647a4a6e52c1fa707a35724bac2fd83d198

    SHA256

    1a827f6735dd7a5245f6436fde0679f46a9aff7cf2eec99c941b300df91ad49d

    SHA512

    b4bb0864ab18f7353a85b1712189dbe41e2497310bcf85aa0ce0ac762e57cd13bbd859d15ef455de745d83bf5c996d6480a4cf60872fdffd252bdf942d42d7a4