Overview

overview

10

Static

static

7

06dbf0e0bf...fe.apk

android-9-x86

10

06dbf0e0bf...fe.apk

android-10-x64

10

06dbf0e0bf...fe.apk

android-11-x64

10

CardViewController.js

windows7-x64

1

CardViewController.js

windows10-2004-x64

1

CloudCardV...ler.js

windows7-x64

1

CloudCardV...ler.js

windows10-2004-x64

1

ImagesController.js

windows7-x64

1

ImagesController.js

windows10-2004-x64

1

ImgViewController.js

windows7-x64

1

ImgViewController.js

windows10-2004-x64

1

Template.js

windows7-x64

1

Template.js

windows10-2004-x64

1

ViewController.js

windows7-x64

1

ViewController.js

windows10-2004-x64

1

android_utils.js

windows7-x64

1

android_utils.js

windows10-2004-x64

1

aps-mraid.js

windows7-x64

1

aps-mraid.js

windows10-2004-x64

1

attachment...ory.js

windows7-x64

1

attachment...ory.js

windows10-2004-x64

1

attachment...ler.js

windows7-x64

1

attachment...ler.js

windows10-2004-x64

1

autoSaveController.js

windows7-x64

1

autoSaveController.js

windows10-2004-x64

1

ccBccFromS...ler.js

windows7-x64

1

ccBccFromS...ler.js

windows10-2004-x64

1

composeCon...ler.js

windows7-x64

1

composeCon...ler.js

windows10-2004-x64

1

composer.html

windows7-x64

1

composer.html

windows10-2004-x64

1

composer.js

windows7-x64

1

Analysis

  • max time kernel
    641539s
  • max time network
    134s
  • platform
    android_x86
  • resource
    android-x86-arm-20230621-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
  • submitted
    05-07-2023 13:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    06dbf0e0bfab9f74c0744b8fe.apk

  • Size

    3.8MB

  • MD5

    0a296c35e1d7ac2c69cd62b3de246a19

  • SHA1

    9f941ba530d50b907257f9558697cd6ba1617f80

  • SHA256

    06dbf0e0bfab9f74c0744b8fe29bec1cf48171bce9df7ff56be34a62babf15d2

  • SHA512

    44e35b961022871e634d006e575a04c1a3b0cc7d0f07ba23dbdca64435a5aec635002fc701da5f02e6755eb773c5d01699ab8a304580700c74c3a2051e5fccca

  • SSDEEP

    98304:2QJ1CPm1vI5Pzb9p9UQs6/TO41SUEsKo9xOssKR1eXl1TDr2K:2QHLIvpXRbOCJ1qs8XvD2K

Score
10/10
flubotbankerevasioninfostealerransomwaretrojan

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

    bankertrojaninfostealerflubot
  • FluBot payload 4 IoCs
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.eg.android.AlipayGphone
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4113
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/oat/x86/ySq3pvnl.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4299

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/oat/x86/ySq3pvnl.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/oat/x86/ySq3pvnl.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk
    Filesize

    4.7MB

    MD5

    fc4caef2883f0c750e6560102ee2ff70

    SHA1

    52de160de2f277dc9b7fa0220dc23e16ca22d1bb

    SHA256

    3dbe43af14530a6db63ed4ee7064663086d35768e6a0b0cbfd5493b0ec9b06ea

    SHA512

    6f540cb3a8ff85480c97218416aaaa9627c03fa7781347e507f1579a18e4215da404114c9bcc082121f99f497ad55c16ba52b734c15edb2111b3c9bfee7a06da

    Download Submit

  • /data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk
    Filesize

    4.7MB

    MD5

    fc4caef2883f0c750e6560102ee2ff70

    SHA1

    52de160de2f277dc9b7fa0220dc23e16ca22d1bb

    SHA256

    3dbe43af14530a6db63ed4ee7064663086d35768e6a0b0cbfd5493b0ec9b06ea

    SHA512

    6f540cb3a8ff85480c97218416aaaa9627c03fa7781347e507f1579a18e4215da404114c9bcc082121f99f497ad55c16ba52b734c15edb2111b3c9bfee7a06da

    Download Submit

  • /data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk
    Filesize

    4.7MB

    MD5

    6ddfba05ad15f0da569396f752b7c30c

    SHA1

    bc79d30234ff48ff14df270645e012c5a1749d4d

    SHA256

    9deb097691b098fd5960cd1bfaea8c75cce18aea32d61f6c37c20419b4fd6d9d

    SHA512

    450f031d2dede3ace018acbe7f4e89b08fa3da69d9649521585d099b98a1a3952a8efd03dca1314caec5c8ed66c46535f73fb922a59e23f5ea3b06aab5bbf2f5

    Download Submit

  • /data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk
    Filesize

    4.7MB

    MD5

    fc4caef2883f0c750e6560102ee2ff70

    SHA1

    52de160de2f277dc9b7fa0220dc23e16ca22d1bb

    SHA256

    3dbe43af14530a6db63ed4ee7064663086d35768e6a0b0cbfd5493b0ec9b06ea

    SHA512

    6f540cb3a8ff85480c97218416aaaa9627c03fa7781347e507f1579a18e4215da404114c9bcc082121f99f497ad55c16ba52b734c15edb2111b3c9bfee7a06da

    Download Submit

  • /data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.eg.android.AlipayGphone/shared_prefs/Voicemail.xml
    Filesize

    133B

    MD5

    eb46c6fcc15e40518abc5654b601b4fc

    SHA1

    6c516165243a8397c5596d047b55d5089edad159

    SHA256

    5d26e659b69a43251828a44dde1a2ed94d8a94916b3ac2337f30bf4d88ae3d4f

    SHA512

    098e652b573bf972027b1e95bf4806621f259db4fb2e4d3fd7322acbfeb248329138585ed602f15c3029b95655ea424c5b649036b280a28b78bef9f4568be231

    Download Submit

  • /data/user/0/com.eg.android.AlipayGphone/shared_prefs/Voicemail.xml
    Filesize

    197B

    MD5

    de8daaa3523a33e653fc8fc482928cf1

    SHA1

    e40b04f64dc153801f8c233d40c252cd01851909

    SHA256

    712f3d98da8c42e6b6596c8b741ef14ef0f5a690114ea39b7329cdaec68f41d9

    SHA512

    11557d7992efe38d97978cbda93ce4575d1a00591ac7f3faff212999ee0965c470b5c2ef629d2ec5024b6517cf916087f995334df47406bc833db5be6b2620a2

    Download Submit