Overview

overview

10

Static

static

7

8c9d734593...45.apk

android-9-x86

1

8c9d734593...45.apk

android-10-x64

10

8c9d734593...45.apk

android-11-x64

10

appboy-htm...ent.js

windows7-x64

1

appboy-htm...ent.js

windows10-2004-x64

1

t-rex.html

windows7-x64

1

t-rex.html

windows10-2004-x64

1

vk_dex.apk

android-9-x86

vk_dex.apk

android-10-x64

vk_dex.apk

android-11-x64

Analysis

  • max time kernel
    530699s
  • max time network
    162s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230831-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system
  • submitted
    11-10-2023 10:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8c9d7345935d46c1602936934b600bb55fa6127cbdefd343ad5ebf03114dbe45.apk

  • Size

    5.5MB

  • MD5

    90960e63a4d5a871f2f5617f6e26c382

  • SHA1

    efe3f8785f17d1add3642a2607ef346ea9bbf962

  • SHA256

    8c9d7345935d46c1602936934b600bb55fa6127cbdefd343ad5ebf03114dbe45

  • SHA512

    b781b2a3882bbf2a86c6759be88a69a9260363f5d47c1da963946bf0d82c86de30edd1ca6b05f861aa4e828f5d0ff0e8a7b71b931ce00f031244b59be1d323bd

  • SSDEEP

    98304:2x2natN0Gwuybg0chHxA/PfECifHyUiCAnBT7rXxrZSFES2PHsQMnZvgnfe3W3S7:2x9735ypcJxA/oLArFSqPHsQMAe3P7

Score
10/10
flubotbankerinfostealerransomwaretrojan

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

    bankertrojaninfostealerflubot
  • FluBot payload 1 IoCs
  • Makes use of the framework's Accessibility service. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.snda.wifilocating
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.snda.wifilocating/hiw4hjvhcd/ejloihYdv8o4fdY/base.apk.ojvrhf81.jnl
    Filesize

    5.1MB

    MD5

    2523224ea72332eda17242335b1d5965

    SHA1

    e469987188975bad5210ea409a72af509aeafd4a

    SHA256

    ac1b9c1381fd71afedf0b8421bc173f9f9b4646233df94ff4f96643f0d75618d

    SHA512

    2947d2f841ab99ed860bce89c92d17f101e1bb62b787554fa7044bf81a807e37930ebed16fcfddb9ecf633e34769576245a770de7eae6254f262dfbc2c206522

    Download Submit

  • /data/user/0/com.snda.wifilocating/hiw4hjvhcd/ejloihYdv8o4fdY/tmp-base.apk.ojvrhf87112407347457093851.jnl
    Filesize

    1.4MB

    MD5

    2c55fbe1de1fab77ab630f3c3d41977c

    SHA1

    2176c3f9d33725d83d060598425717fccb4e818e

    SHA256

    130a63513c8195d05c342887aa283324d4b181c9c6e5704c86204abaa8004684

    SHA512

    fd7466fbfd7dbd1712075b7389e84472ae1ca9e988164a6eb1ba6638aca85ee451cbf384c0e65b5794fb8e36f946850178e5601b535ecb75a022b8fa43cc2803

    Download Submit