Overview
overview
10Static
static
7base.apk
android-9-x86
10base.apk
android-10-x64
10base.apk
android-11-x64
10Zw6IGlco.ppt
windows7-x64
1Zw6IGlco.ppt
windows10-2004-x64
1license-ru.html
windows7-x64
1license-ru.html
windows10-2004-x64
1license.html
windows7-x64
1license.html
windows10-2004-x64
1UserDict.pyc
windows7-x64
3UserDict.pyc
windows10-2004-x64
3_abcoll.pyc
windows7-x64
3_abcoll.pyc
windows10-2004-x64
3_sysconfigdata.pyc
windows7-x64
3_sysconfigdata.pyc
windows10-2004-x64
3_weakrefset.pyc
windows7-x64
3_weakrefset.pyc
windows10-2004-x64
3abc.pyc
windows7-x64
3abc.pyc
windows10-2004-x64
3copy_reg.pyc
windows7-x64
3copy_reg.pyc
windows10-2004-x64
3genericpath.pyc
windows7-x64
3genericpath.pyc
windows10-2004-x64
3linecache.pyc
windows7-x64
3linecache.pyc
windows10-2004-x64
3os.pyc
windows7-x64
3os.pyc
windows10-2004-x64
3posixpath.pyc
windows7-x64
3posixpath.pyc
windows10-2004-x64
3re.pyc
windows7-x64
3re.pyc
windows10-2004-x64
3site.pyc
windows7-x64
3Analysis
-
max time kernel
2927688s -
max time network
168s -
platform
android_x64 -
resource
android-x64-arm64-20220823-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system -
submitted
12-06-2023 07:25
Static task
static1
Behavioral task
behavioral1
Sample
base.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
base.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral3
Sample
base.apk
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral4
Sample
Zw6IGlco.ppt
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
Zw6IGlco.ppt
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
license-ru.html
Resource
win7-20230220-en
Behavioral task
behavioral7
Sample
license-ru.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
license.html
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
license.html
Resource
win10v2004-20230221-en
Behavioral task
behavioral10
Sample
UserDict.pyc
Resource
win7-20230220-en
Behavioral task
behavioral11
Sample
UserDict.pyc
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
_abcoll.pyc
Resource
win7-20230220-en
Behavioral task
behavioral13
Sample
_abcoll.pyc
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
_sysconfigdata.pyc
Resource
win7-20230220-en
Behavioral task
behavioral15
Sample
_sysconfigdata.pyc
Resource
win10v2004-20230221-en
Behavioral task
behavioral16
Sample
_weakrefset.pyc
Resource
win7-20230220-en
Behavioral task
behavioral17
Sample
_weakrefset.pyc
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
abc.pyc
Resource
win7-20230220-en
Behavioral task
behavioral19
Sample
abc.pyc
Resource
win10v2004-20230220-en
Behavioral task
behavioral20
Sample
copy_reg.pyc
Resource
win7-20230220-en
Behavioral task
behavioral21
Sample
copy_reg.pyc
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
genericpath.pyc
Resource
win7-20230220-en
Behavioral task
behavioral23
Sample
genericpath.pyc
Resource
win10v2004-20230221-en
Behavioral task
behavioral24
Sample
linecache.pyc
Resource
win7-20230220-en
Behavioral task
behavioral25
Sample
linecache.pyc
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
os.pyc
Resource
win7-20230220-en
Behavioral task
behavioral27
Sample
os.pyc
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
posixpath.pyc
Resource
win7-20230220-en
Behavioral task
behavioral29
Sample
posixpath.pyc
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
re.pyc
Resource
win7-20230220-en
Behavioral task
behavioral31
Sample
re.pyc
Resource
win10v2004-20230220-en
Behavioral task
behavioral32
Sample
site.pyc
Resource
win7-20230220-en
General
-
Target
base.apk
-
Size
3.3MB
-
MD5
15328ea6d31bef8ddd15a81e0f5a549b
-
SHA1
c52f12651d91a9bf0d625a879b34d194eba69ed4
-
SHA256
a778818cc08d213d1f66db5fa8b34aabc862569ecb99fd1aea37ff6ccab48400
-
SHA512
5939a527d289315ff6d354bbd6e834ae9b3f452aebc54114a0fb46cb5422e5537ff0592aa62fbd20d753162f6a3ae56cfd97c4320613d1377a9b5a7d6a525336
-
SSDEEP
49152:qLzu436uB6iejEyNRe1kqqGI18iNwDelhcTUr4T1S0NwBbGJ3H5+ELr42SKn2IQI:qHuKB6BzReWqqGWNN8g4ETBaJ7n2Izl
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 3 IoCs
resource yara_rule behavioral3/files/4516-0.dat family_flubot behavioral3/memory/4516-0.dex family_flubot behavioral3/memory/4516-1.dex family_flubot -
Makes use of the framework's Accessibility service. 3 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.sina.weibo Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.sina.weibo Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.sina.weibo -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.sina.weibo/app_apkprotector_dex/Zw6IGlco.ppt 4516 com.sina.weibo /data/user/0/com.sina.weibo/app_apkprotector_dex/Zw6IGlco.ppt 4516 com.sina.weibo -
Requests enabling of the accessibility settings. 1 IoCs
description ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS com.sina.weibo -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.sina.weibo -
Removes a system notification. 1 IoCs
description ioc Process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.sina.weibo
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD544e5099c255320beb84c347c28d9ffba
SHA132bccc9ebf25868ac299f14f45da44e166f424f1
SHA25651a29d7ced99b68bf97e8dfff99f3a99aa157c7e6f86161e83935f750c5c73d3
SHA5124efcbd07e80007e6b2c178c203a218cdcdba2c58347010485148e237aa4bc4b6a8c9aa2b53a9907b430349a1643e5e262e4049541dbab09a171b4f0ce73a9d88
-
Filesize
2.3MB
MD544e5099c255320beb84c347c28d9ffba
SHA132bccc9ebf25868ac299f14f45da44e166f424f1
SHA25651a29d7ced99b68bf97e8dfff99f3a99aa157c7e6f86161e83935f750c5c73d3
SHA5124efcbd07e80007e6b2c178c203a218cdcdba2c58347010485148e237aa4bc4b6a8c9aa2b53a9907b430349a1643e5e262e4049541dbab09a171b4f0ce73a9d88
-
Filesize
2.3MB
MD544e5099c255320beb84c347c28d9ffba
SHA132bccc9ebf25868ac299f14f45da44e166f424f1
SHA25651a29d7ced99b68bf97e8dfff99f3a99aa157c7e6f86161e83935f750c5c73d3
SHA5124efcbd07e80007e6b2c178c203a218cdcdba2c58347010485148e237aa4bc4b6a8c9aa2b53a9907b430349a1643e5e262e4049541dbab09a171b4f0ce73a9d88
-
Filesize
133B
MD577c774857cada47f95e5ee64d62cfb27
SHA1e31c8864f56c037cf8e9bb7ee8eee6a28b8d15dc
SHA256da8fc6118562e0a46692b12b45fff5281541e1900a95dfc04a7089a19a5da1e2
SHA512a9c8469ea8ddafcd5e1b2819f7509e257efcaf5d346833a86b22ff52cd3855496f48855d78b1a84d8cb17b3fddefb548e364cf81c963545b17f14f26ba42b65f
-
Filesize
197B
MD52205070cd66cc2c94bc6116cad6a3472
SHA1369b9647a4a6e52c1fa707a35724bac2fd83d198
SHA2561a827f6735dd7a5245f6436fde0679f46a9aff7cf2eec99c941b300df91ad49d
SHA512b4bb0864ab18f7353a85b1712189dbe41e2497310bcf85aa0ce0ac762e57cd13bbd859d15ef455de745d83bf5c996d6480a4cf60872fdffd252bdf942d42d7a4