Analysis
-
max time kernel
530018s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
resource tags
-
submitted
11-10-2023 10:08
General
-
Target
e93a4e8bec4e2bf47157e55be150c8fb62c38cd4ca180b473f53259fa44cdd48.apk
-
Size
4.2MB
-
MD5
58fe07645a418f93efeeeacb04dd16c0
-
SHA1
62a5e53b179e4b6b66f8094db788afd2e3eb550f
-
SHA256
e93a4e8bec4e2bf47157e55be150c8fb62c38cd4ca180b473f53259fa44cdd48
-
SHA512
2b358681bc4429b34d5777f9f778a056addfd26d0497a9a5282ead8f83cbb2845b292b3fbbd4096925b39d0dd08103d586afff7b6e7a183d5f34c8ac31a44e11
-
SSDEEP
98304:4nXK5t8UQUNbK7+QQH5U+uR3fO09yXPzxh8wAZSKEscl:4Xe1N+7DXXxfO0yLAZA
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 2 IoCs
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.qiyi.video1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/base.apk.ffffhss1.jhd --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/oat/x86/base.apk.ffffhss1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
859KB
MD51a3f0c6e6397d1418f11031ff7e84f1d
SHA196354333f51d401eed9d5beb4d20f2312134156d
SHA256acee475c273eec2fcfe679750d098af117b5288f8fcc2843fc8d9ef7214c52be
SHA512128385a201c4b9a264f919a533a5647cb1cc30fc10f6a77c90c596f8a88590fa5f49a7b88f68bea6637c1a9c4dbaee918094f0f020619e30146ddfb157e18167
-
Filesize
2.3MB
MD5e4e94c01b206822956efb73c43126865
SHA1d7d682de479e5354f7d4ef366d6ebf74088d3aef
SHA256535a4d7b63e312957f4774e7359b3eae1c519d65cb7612e9960869617aacb0eb
SHA512f5b4449026b79060cca0d30925c05abece30a453e9fdf54303b703b6947f4d092ead466f4616f1795a4428a1867323271d2410c11a7f30ad689a237418118331
-
Filesize
2.3MB
MD5dd62e312a1d44d6a0fa4aceeef1816be
SHA1e95f766465f9422c368d396abf0a71d3e89f9acc
SHA25663d31005d25172a341177dff397fb50469fe0434a8966eb73bc57eb7b6e60883
SHA512c92d50a6db6da41cb94747f10d1426407268033ded04aab920efdc00aa334fe1680d5dcb6c00b007d8a12a2afccd7b990c64bc940fde634809ee3a668651d608