Analysis
-
max time kernel
377219s -
max time network
162s -
platform
android_x64 -
resource
android-x64-20230831-en -
resource tags
-
submitted
09-10-2023 22:03
General
-
Target
4751009aa937ea9fc90d879b84e7f745ac606080e9bb783ec6a2b222fdff4da7.apk
-
Size
4.6MB
-
MD5
3c95df948d9fb9c64b1c71b8eb7fad05
-
SHA1
a4be8061655f1ef9eacc906af1465aca68a27a9b
-
SHA256
4751009aa937ea9fc90d879b84e7f745ac606080e9bb783ec6a2b222fdff4da7
-
SHA512
54f4bfc02a7bd169f2f4da48c1a247403ef2ab74986331e922c7d17d66225a66fd937ffbf51d2977395a746b73f4f5ca3be7911512b856eef418eee0e02194f4
-
SSDEEP
98304:CWAMjd6nGZjaO+DVre7FnOy/vw17D00UrcnDqAjDd0BhuenDPWcrOSxyu526XT:nR6nGVaOKyR07D07cnDqIDaBznDPW/u5
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 2 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 5 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.tencent.mobileqq1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
421KB
MD58345c73b46814e1384ff8462248b23af
SHA14d9a4db4c7cf0a19d041d9191cef90df5d186aad
SHA25632fbfe031ecde2df1f5427303b61eb84492d3edf22d6a133b002a00bba7c1439
SHA5125895dbad205eb6a72516745f18d1ad49cdfde4eaa197df752447e488fe976f91eba305499bd8b6abc5c9746b90f377b669a583104b20d5d8bc33fd5bf0b23d74
-
Filesize
4.7MB
MD57e343cbc45b618d05182d74bd61826b2
SHA102ee96263b3b967e570e8ddb1fa36cb21032b71b
SHA256324b5af2ec2d78bb57b1552f429af51ac8d65f7fa277217ae8d4371ab14178d1
SHA51248cbd8a5b246cf9d6ec16558ab12af131439837094c63a64046de384da933593459fb1aec126393bbe3b2b8ca19437f38b68364c9f158023a7b1a35e6901c705
-
Filesize
396KB
MD5b93f8047ed660629c2efe0aef2bbe0e4
SHA17c63d6781b3f4e3ebecea0eabd707a9ffdbaa774
SHA256b6c05e60710e14ce7e7d02cfca7230d6251217374e465aaaca845426017ea89b
SHA5123a150d1227d123454018eeb232131b25d251277edbaa4e53c059499d9febf15eec429e0c419d9aa7bf5de212c86209e97a15560469b6322ec3c404d431b71e0e
-
Filesize
927KB
MD559181d8dad336ebd1d54c725a919fea2
SHA1c77cf32355eb8c0f3e8697d0be09e8cb4268df25
SHA256b34520399710770e5ecde27fa2189deb7fdcc665865ac20403c5e5d68d7551a5
SHA5126bc3543ae1197821fcb080c8c11bcfbb691a9d47d191fa1bb139efca39d43c262830f62494f3d34859f94cc74627e0b5953e0aade12ce7941aa053e76d57e03f
-
Filesize
2.0MB
MD5c016c151db51699d0918b5ea2c05264b
SHA140f2fe439d5a40bc82f94e3d74ab265822ad4f43
SHA256b6be8e1e022f2f7eba312c87f79132cdb2c1a599c4c28bd2f85a5f0303ba175d
SHA5129ba8295477eb032f03df7ab4d5050d402c79ac82f91884d5d6a45c6e5db9ecd5ebfeb8c3f29915f6cfb9d1f9c17364987cdaa7694dfe3dec963a80914a71a403
-
Filesize
2.0MB
MD5c016c151db51699d0918b5ea2c05264b
SHA140f2fe439d5a40bc82f94e3d74ab265822ad4f43
SHA256b6be8e1e022f2f7eba312c87f79132cdb2c1a599c4c28bd2f85a5f0303ba175d
SHA5129ba8295477eb032f03df7ab4d5050d402c79ac82f91884d5d6a45c6e5db9ecd5ebfeb8c3f29915f6cfb9d1f9c17364987cdaa7694dfe3dec963a80914a71a403