Analysis
-
max time kernel
529419s -
max time network
158s -
platform
android_x64 -
resource
android-x64-20230831-en -
resource tags
-
submitted
11-10-2023 10:12
General
-
Target
1dc84f5f1ee6daf33f5da0d0d82f252c64274a771c6214170eae441d18447fea.apk
-
Size
4.8MB
-
MD5
d086e98cc813dc57c3b2b9a299ae2928
-
SHA1
94078ef7ca8fbecd5194f082902ca991650e29e7
-
SHA256
1dc84f5f1ee6daf33f5da0d0d82f252c64274a771c6214170eae441d18447fea
-
SHA512
dfccb95a17e570225938bfa82d6a9d8c1f22e172e45c8a357b3a05d64ba670d372d69d38e92d9250191f10db454a2246d2ab5877fb759ee0bd2bd33b199a16cc
-
SSDEEP
98304:8D6FN/qg/gvgr9MzqDQGEnZmC1ybGTYsqVyxrUA:8D8N/qgYosNZJ1tfqVyNUA
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.baidu.searchbox1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
915KB
MD512d8116c48a350e6c32a7335790248e6
SHA192a91cb4abee3617ea62a34a61a2de942020552d
SHA256b7b7560133d2b2259607a1776ba3496ed7cbb6466c1901552d498186a974a1c8
SHA51217043ad81530112b15ef9c0344236932641dee2275ba286fa8fc1cce0692c1f41a151b035b96485956c706738c45b259db9b7980e5feb7daa09cd01e8cb08dd5
-
Filesize
2.0MB
MD5276dda73a33e26b92a856aee64bab6f6
SHA139594ad2317acae957af97aa710ef870e6bc7ee7
SHA25609d188a7bc9be9d161c96fe13890c94a451645067a6d34fb0fca6d6e0390eaa2
SHA512d80937e9acc83d5b56e8fc377b36f96b8c56af1da08b6fde7a1fa25430df5e395d363bcc64eeb418ee3d9ceacfb085a5063cced4f2192b66bb9ac670f80926d0