Analysis
-
max time kernel
377391s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
resource tags
-
submitted
09-10-2023 22:05
General
-
Target
9cb020a79c3a1028b5a278712923a3246978c68a544009480e57887e14d674df.apk
-
Size
4.8MB
-
MD5
c10214331255a0c1e74fea2aac739e8c
-
SHA1
5ce619517de7a4c22dd473f6bfb2e989b543d864
-
SHA256
9cb020a79c3a1028b5a278712923a3246978c68a544009480e57887e14d674df
-
SHA512
307058d35b165cefe2485f97d046d0baf597ff43991705b93732c32c701e8e52e3012e30240364992c59bd8d7ad81c3ac1db75d7927c6e8d14e6c92c598cb452
-
SSDEEP
98304:BS5spIP290ty+u50+F1/ZlZVZqMA3gdj7DrX8N+fU33W3Ys7pE0eV7:B8spU292yE+33ZVZ9t0Yf+3SdReN
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.moji.mjweather1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
813KB
MD54b83f701678b6db13ff34f4ffc9e0b5e
SHA1a5537ff82d1faadeb3a9e28b62e26ed66a14f379
SHA256a6f6135c38827e8d622522eafa487b5ea4267ebcce6113ab799e0f9367ae5b5f
SHA512c987433c90f525791d5666e4c44310734e3529203768e448a9a828f692ab273ee6fa2afce2450d962f8393cccec71a37303ef97f3553cbee17684dbb8cbbf87c
-
Filesize
2.2MB
MD5869a9724da56cd72adb674bc5a79f6ef
SHA101e6fd521e80d4abfec5f7a2db690b7405d69e01
SHA2567ec429f886d3309476a85627e746756b559a645138e9e57dedc9f60664a5eb97
SHA51262687bf58593b44e37f6a4cabed8f472da1f122e14c3d90dfc848af7d4808aad25b2a7c92b905bb51ebfca10de9aa933a14f7a5ad4518c8c48a0f093599771dd