Analysis
-
max time kernel
4265260s -
max time network
157s -
platform
android_x86 -
resource
android-x86-arm-20231023-en -
resource tags
-
submitted
23-11-2023 22:02
General
-
Target
53c46a3f650e903192f0b094b3f063a8d3459713d80cfc2f2af5b389c165e76e.apk
-
Size
4.9MB
-
MD5
5629475dba989c8d00bfcd62396cab9c
-
SHA1
c24a5a876affb9e62614a214e0480d11d920e9e5
-
SHA256
53c46a3f650e903192f0b094b3f063a8d3459713d80cfc2f2af5b389c165e76e
-
SHA512
25a6b0c9c971941d8e09a888a977048b9bb60b26c440b271c4101b0c6305339ff576294e0e4ebc0d1dac640deb70967528af7c91cf7a95c1d2afd09188fa7995
-
SSDEEP
98304:RZ+geGajn0awMkSFqN6Dfy/UI+nhtf7QM4FSoD+zLRSMeu/IuFwAKLPND3Pdr1zf:RZ+gWjfnj0Ajy/mt1oYdPIuFwDBD3Vhf
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 2 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.qiyi.video1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.qiyi.video/Hgu7gdFghp/ekUefesugG8jgry/base.apk.IqyttgI1.G8y --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.qiyi.video/Hgu7gdFghp/ekUefesugG8jgry/oat/x86/base.apk.IqyttgI1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
926KB
MD5ae3c908e2a57ff0fc9d3b82f5d9787a0
SHA11e6dfff7b2617d03d9d667999720d91f99153896
SHA2564775ab30db23a37f1c7402e9f43d2ab222dcd6468f549266ae5289757ba0bce6
SHA512ba74eaf029ce14ec984be6babe5127e1cbd5761f1ba3f83f9510678dc1a08295e072ded7cfd83e13778219804dfd16286f75518bdaf7495172b074d7c2d12f53
-
Filesize
2.0MB
MD5dd7a0c8ade494523b9f57371533f6f3d
SHA1cd6f7f8a0efbd76286d88207ba820adbf3b6adb3
SHA256c601c0334ba5ebb03111b9d7290a677d094f1b90c6489d541f1845d25074f15f
SHA5121ffd65dcc4eba1b6dd9f78daf6d921da2759844b1e2096716cd0404f11db6d511c8ead4e161ab637aab6ba21b70cd588db2d6c772b2800a400a1abad138ae0a9
-
Filesize
2.0MB
MD5dd7a0c8ade494523b9f57371533f6f3d
SHA1cd6f7f8a0efbd76286d88207ba820adbf3b6adb3
SHA256c601c0334ba5ebb03111b9d7290a677d094f1b90c6489d541f1845d25074f15f
SHA5121ffd65dcc4eba1b6dd9f78daf6d921da2759844b1e2096716cd0404f11db6d511c8ead4e161ab637aab6ba21b70cd588db2d6c772b2800a400a1abad138ae0a9