Analysis
-
max time kernel
530035s -
max time network
163s -
platform
android_x64 -
resource
android-x64-arm64-20230831-en -
resource tags
-
submitted
11-10-2023 10:08
General
-
Target
e93a4e8bec4e2bf47157e55be150c8fb62c38cd4ca180b473f53259fa44cdd48.apk
-
Size
4.2MB
-
MD5
58fe07645a418f93efeeeacb04dd16c0
-
SHA1
62a5e53b179e4b6b66f8094db788afd2e3eb550f
-
SHA256
e93a4e8bec4e2bf47157e55be150c8fb62c38cd4ca180b473f53259fa44cdd48
-
SHA512
2b358681bc4429b34d5777f9f778a056addfd26d0497a9a5282ead8f83cbb2845b292b3fbbd4096925b39d0dd08103d586afff7b6e7a183d5f34c8ac31a44e11
-
SSDEEP
98304:4nXK5t8UQUNbK7+QQH5U+uR3fO09yXPzxh8wAZSKEscl:4Xe1N+7DXXxfO0yLAZA
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
com.qiyi.video1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5dd62e312a1d44d6a0fa4aceeef1816be
SHA1e95f766465f9422c368d396abf0a71d3e89f9acc
SHA25663d31005d25172a341177dff397fb50469fe0434a8966eb73bc57eb7b6e60883
SHA512c92d50a6db6da41cb94747f10d1426407268033ded04aab920efdc00aa334fe1680d5dcb6c00b007d8a12a2afccd7b990c64bc940fde634809ee3a668651d608
-
Filesize
859KB
MD51a3f0c6e6397d1418f11031ff7e84f1d
SHA196354333f51d401eed9d5beb4d20f2312134156d
SHA256acee475c273eec2fcfe679750d098af117b5288f8fcc2843fc8d9ef7214c52be
SHA512128385a201c4b9a264f919a533a5647cb1cc30fc10f6a77c90c596f8a88590fa5f49a7b88f68bea6637c1a9c4dbaee918094f0f020619e30146ddfb157e18167