Analysis
-
max time kernel
1820835s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
resource tags
-
submitted
06-09-2023 22:01
General
-
Target
6f740ba69a5020a316d67e0341179ad03f9820fdde6501591255e9e98b06c0ae.apk
-
Size
4.1MB
-
MD5
c7eedb71b543a24908b74b5f9e3894d4
-
SHA1
c080c3595c9337eb15a122e0fdd9776ee38cb347
-
SHA256
6f740ba69a5020a316d67e0341179ad03f9820fdde6501591255e9e98b06c0ae
-
SHA512
0c11b479fcf5914658796575674f867699a39d7b092862e5b460f7b239c005fb09954377bfbf7952a0f13f9112940193f31bf2241000d782cc5bcfc504fb93c1
-
SSDEEP
98304:ixsR3c4OlEK4Sg7FJDEM2pHGRzUEWoMd0e4:iyJjKlpHPoMdP4
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 2 IoCs
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.baidu.searchbox1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.baidu.searchbox/hhjsGGofgz/hclmgvlGfsmphbh/base.apk.vaahjhh1.axY --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.baidu.searchbox/hhjsGGofgz/hclmgvlGfsmphbh/oat/x86/base.apk.vaahjhh1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
859KB
MD5a21eb4bfd58a977d1719df1ddecbcc24
SHA175c2cf2e965970f46f5affb84927a10b011f7c33
SHA2561bd6c045f1eb5ad681cbbbf929c40820fdeacc4be73624ddc0a929d64304ea9e
SHA5128ae636a200b08adee4681575a53c6715055d269e2d95aeaca3d99075cccc14b1f4fcd8e09b3f6b470e18cefc9d606ee1e539e4439309ac2d208b4218c0654dc1
-
Filesize
2.3MB
MD513814cd4a85200824ad4d9e7d8299783
SHA1251613e8cb67688293d2fcf5d5e3a9225b958516
SHA256af762830132612b5283aa5b0897f9cec8183f22bcd04e058e00240da6fe981cc
SHA512fcd824d6c6e465d14c910d7b161eaddc0f03b9e44e7467221be32331252cf45af2130c2714f7d6978ff192301160bd9e5f0c6ffae5c86e2d40029d814032a9c1
-
Filesize
2.3MB
MD5c9bb380d82552712b0b690d8888c4ee6
SHA1e541cfefb00e67ee94bebc3344acf3b8e1dc40b6
SHA256227f7f46e0c88513b8b6271107393206416aa965b36a86ad163aae5cd752861c
SHA5128fc922bbf5c7e1ee8b4fa00b770229a2631a30e45ee7092ea2f1c6e210468605849373d0a5de9df072116e58136d75829202faf58d0b58c7ae57a386c58337d4