Overview

overview

10

Static

static

7

06dbf0e0bf...fe.apk

android-9-x86

10

06dbf0e0bf...fe.apk

android-10-x64

10

06dbf0e0bf...fe.apk

android-11-x64

10

CardViewController.js

windows7-x64

1

CardViewController.js

windows10-2004-x64

1

CloudCardV...ler.js

windows7-x64

1

CloudCardV...ler.js

windows10-2004-x64

1

ImagesController.js

windows7-x64

1

ImagesController.js

windows10-2004-x64

1

ImgViewController.js

windows7-x64

1

ImgViewController.js

windows10-2004-x64

1

Template.js

windows7-x64

1

Template.js

windows10-2004-x64

1

ViewController.js

windows7-x64

1

ViewController.js

windows10-2004-x64

1

android_utils.js

windows7-x64

1

android_utils.js

windows10-2004-x64

1

aps-mraid.js

windows7-x64

1

aps-mraid.js

windows10-2004-x64

1

attachment...ory.js

windows7-x64

1

attachment...ory.js

windows10-2004-x64

1

attachment...ler.js

windows7-x64

1

attachment...ler.js

windows10-2004-x64

1

autoSaveController.js

windows7-x64

1

autoSaveController.js

windows10-2004-x64

1

ccBccFromS...ler.js

windows7-x64

1

ccBccFromS...ler.js

windows10-2004-x64

1

composeCon...ler.js

windows7-x64

1

composeCon...ler.js

windows10-2004-x64

1

composer.html

windows7-x64

1

composer.html

windows10-2004-x64

1

composer.js

windows7-x64

1

Analysis

  • max time kernel
    641559s
  • max time network
    168s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230621-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230621-enlocale:en-usos:android-11-x64system
  • submitted
    05-07-2023 13:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    06dbf0e0bfab9f74c0744b8fe.apk

  • Size

    3.8MB

  • MD5

    0a296c35e1d7ac2c69cd62b3de246a19

  • SHA1

    9f941ba530d50b907257f9558697cd6ba1617f80

  • SHA256

    06dbf0e0bfab9f74c0744b8fe29bec1cf48171bce9df7ff56be34a62babf15d2

  • SHA512

    44e35b961022871e634d006e575a04c1a3b0cc7d0f07ba23dbdca64435a5aec635002fc701da5f02e6755eb773c5d01699ab8a304580700c74c3a2051e5fccca

  • SSDEEP

    98304:2QJ1CPm1vI5Pzb9p9UQs6/TO41SUEsKo9xOssKR1eXl1TDr2K:2QHLIvpXRbOCJ1qs8XvD2K

Score
10/10
flubotbankerevasioninfostealerransomwaretrojan

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

    bankertrojaninfostealerflubot
  • FluBot payload 3 IoCs
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings. 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.eg.android.AlipayGphone
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    • Requests enabling of the accessibility settings.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4371

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk
    Filesize

    4.7MB

    MD5

    fc4caef2883f0c750e6560102ee2ff70

    SHA1

    52de160de2f277dc9b7fa0220dc23e16ca22d1bb

    SHA256

    3dbe43af14530a6db63ed4ee7064663086d35768e6a0b0cbfd5493b0ec9b06ea

    SHA512

    6f540cb3a8ff85480c97218416aaaa9627c03fa7781347e507f1579a18e4215da404114c9bcc082121f99f497ad55c16ba52b734c15edb2111b3c9bfee7a06da

    Download Submit

  • /data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk
    Filesize

    4.7MB

    MD5

    fc4caef2883f0c750e6560102ee2ff70

    SHA1

    52de160de2f277dc9b7fa0220dc23e16ca22d1bb

    SHA256

    3dbe43af14530a6db63ed4ee7064663086d35768e6a0b0cbfd5493b0ec9b06ea

    SHA512

    6f540cb3a8ff85480c97218416aaaa9627c03fa7781347e507f1579a18e4215da404114c9bcc082121f99f497ad55c16ba52b734c15edb2111b3c9bfee7a06da

    Download Submit

  • /data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk
    Filesize

    4.7MB

    MD5

    fc4caef2883f0c750e6560102ee2ff70

    SHA1

    52de160de2f277dc9b7fa0220dc23e16ca22d1bb

    SHA256

    3dbe43af14530a6db63ed4ee7064663086d35768e6a0b0cbfd5493b0ec9b06ea

    SHA512

    6f540cb3a8ff85480c97218416aaaa9627c03fa7781347e507f1579a18e4215da404114c9bcc082121f99f497ad55c16ba52b734c15edb2111b3c9bfee7a06da

    Download Submit

  • /data/user/0/com.eg.android.AlipayGphone/shared_prefs/Voicemail.xml
    Filesize

    133B

    MD5

    984a0100cd057491c894e3be7950a34f

    SHA1

    b5d7cca093c0c076c7909ad3b7d793c9906fe7c5

    SHA256

    3d790151cd5d426ec0eecaad35cba346959ebf211f83481060f25f4b88059979

    SHA512

    cc0ce5a62259d08fdccf246677ab0c4f7d49ec962d883ca13503120feaf06f89de132a3656b4bca42fb4bc27ff9db307182c9cb91fc48dd8b604fc25b9be07f0

    Download Submit

  • /data/user/0/com.eg.android.AlipayGphone/shared_prefs/Voicemail.xml
    Filesize

    197B

    MD5

    910f8195000121eccbe0fcabe44d13b9

    SHA1

    37942b5fb7db694fbffdd667c13efd0718303d5c

    SHA256

    29a56840b0982b025e5972e70079ca22c90969d702422d3e6c853b9c9748161a

    SHA512

    c2b48e23763216d5373e0002526ad4d67e2c1361449fd746d713863102d28b9ec936cfe69165cceed9a41adf392aa05353fd961ff512384eba797486029af152

    Download Submit