Analysis
-
max time kernel
3655341s -
max time network
163s -
platform
android_x64 -
resource
android-x64-arm64-20230831-en -
resource tags
-
submitted
28-09-2023 03:37
General
-
Target
64364f6cf1b893a79d4acd1b54340e66483c8d9a8d354aac2cf4d3b88a6a8ad6.apk
-
Size
5.5MB
-
MD5
e57a895fcd7ac5579e7da4bab7e355b8
-
SHA1
9a992c72d8ba10b2e3350fff6a8d7e3a5955db54
-
SHA256
64364f6cf1b893a79d4acd1b54340e66483c8d9a8d354aac2cf4d3b88a6a8ad6
-
SHA512
6c4d57a11629ae86f9a22a7da265b2ef2644d7e690754d89e6bb573e469e315fbb20dd34d3d7bd7cb5628a001ab137103c9f617e84242588c1cc1e0c326bdbbd
-
SSDEEP
98304:CcifY3Vl4SxOzYtK34GOfg0BVGhrDRosH8Hy0dMOdbV8fm6H8rTrXdztWR23W3Q:CciA02dKdOfvVGhrGscH9MgafmcI5W8X
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.snda.wifilocating1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.1MB
MD57d9b5b109b9c273cefa0338bd76130d8
SHA16e46588e76a10d7456444c2d3ebf584afe616095
SHA256ecea80e5bf9063d23624ccffd4b05340c3c8400648acfe2bdd4a0afed2f8579e
SHA512fb6409ae4905c27a65bd14843fba91b1abca6e443d96770b0c9f5fb099deda8c58c64c60dc911172cc4267f004c81268eb3276a42b074b499d20d1a91747fd25
-
Filesize
1.4MB
MD5eb2a897037f7f6d8e15fe4f7db42446b
SHA191cc998723c14b601ca1eea95786a7ed69f005de
SHA256ed419d6b4c0478b0486d4d061983b4890677d2508179164cacf6911f23659138
SHA512e2c53114beab932c400b68a76a478c418adf68c3f3a3569c101f5b109a3d1a9e33d439127d2238b9ab0580d4d0270cac9f847d3c061b2731ce307c3ceda75b44