Analysis
-
max time kernel
3055300s -
max time network
160s -
platform
android_x64 -
resource
android-x64-20231023.1-en -
resource tags
-
submitted
09-11-2023 22:00
General
-
Target
45c8779a8cc21c9094d548ee40eebd6731c4bba53ebb794b696cd7ef51c9ccbe.apk
-
Size
4.8MB
-
MD5
582086dca931b49a73f0335264d57727
-
SHA1
b00ab4450f5c4af1a997becfbb495d9d083061b0
-
SHA256
45c8779a8cc21c9094d548ee40eebd6731c4bba53ebb794b696cd7ef51c9ccbe
-
SHA512
e6d63f85bb44042bc201a1ac10d8cddf61d00bda8eabf913b1861c63ffc0c0e38c85867528e5f910310a545a4223ba31ada2c0e877eb7310a5b1aa4081d10775
-
SSDEEP
98304:oRoP+Kyuqxm2ePvKAOx6vOIFOd7wWbpHjA99tytfDOhdxQqvyxrAt:4omGqxL0OoOIy1VU99tIDVqvyNe
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.autonavi.minimap1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914KB
MD5563016b4d5cf157ae2922d45d282ab29
SHA1dc8b61cea19a6f16fe2881a42076e976722f259d
SHA25681275f680a3a4b7fb171ea096de6eb57a4b0b47629c1f15341c07434ade6c650
SHA512815ca87f29224fcf9792184de01a12a87a906db2373059d3e9b72d3ef95c78a2ecd44ea87611f751faf4a952d4502da29aad941266291145f8be0e06efef9e29
-
Filesize
2.0MB
MD559cc9e75ae46cbd072fbf414ed75e30c
SHA158d6da275b012b218685d76fa0eb579c2465425d
SHA256d354660248f18ee9e3e918640896e8d092d1da81ae74745f8d0bd0525bc87ad0
SHA5123cdf24311ebe9e7cb7c244ddb7c9683114d49866137b2fd9af6b8911ff814075f1b636b343e8254a6593e573f4b531f4c209bfd76494c0532e66124dca44f686