Analysis
-
max time kernel
530314s -
max time network
161s -
platform
android_x64 -
resource
android-x64-arm64-20230831-en -
resource tags
-
submitted
11-10-2023 10:09
General
-
Target
8c9d7345935d46c1602936934b600bb55fa6127cbdefd343ad5ebf03114dbe45.apk
-
Size
5.5MB
-
MD5
90960e63a4d5a871f2f5617f6e26c382
-
SHA1
efe3f8785f17d1add3642a2607ef346ea9bbf962
-
SHA256
8c9d7345935d46c1602936934b600bb55fa6127cbdefd343ad5ebf03114dbe45
-
SHA512
b781b2a3882bbf2a86c6759be88a69a9260363f5d47c1da963946bf0d82c86de30edd1ca6b05f861aa4e828f5d0ff0e8a7b71b931ce00f031244b59be1d323bd
-
SSDEEP
98304:2x2natN0Gwuybg0chHxA/PfECifHyUiCAnBT7rXxrZSFES2PHsQMnZvgnfe3W3S7:2x9735ypcJxA/oLArFSqPHsQMAe3P7
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.snda.wifilocating1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.1MB
MD52523224ea72332eda17242335b1d5965
SHA1e469987188975bad5210ea409a72af509aeafd4a
SHA256ac1b9c1381fd71afedf0b8421bc173f9f9b4646233df94ff4f96643f0d75618d
SHA5122947d2f841ab99ed860bce89c92d17f101e1bb62b787554fa7044bf81a807e37930ebed16fcfddb9ecf633e34769576245a770de7eae6254f262dfbc2c206522
-
Filesize
1.4MB
MD52c55fbe1de1fab77ab630f3c3d41977c
SHA12176c3f9d33725d83d060598425717fccb4e818e
SHA256130a63513c8195d05c342887aa283324d4b181c9c6e5704c86204abaa8004684
SHA512fd7466fbfd7dbd1712075b7389e84472ae1ca9e988164a6eb1ba6638aca85ee451cbf384c0e65b5794fb8e36f946850178e5601b535ecb75a022b8fa43cc2803