Analysis
-
max time kernel
4265285s -
max time network
164s -
platform
android_x64 -
resource
android-x64-arm64-20231023-en -
resource tags
-
submitted
23-11-2023 22:02
General
-
Target
53c46a3f650e903192f0b094b3f063a8d3459713d80cfc2f2af5b389c165e76e.apk
-
Size
4.9MB
-
MD5
5629475dba989c8d00bfcd62396cab9c
-
SHA1
c24a5a876affb9e62614a214e0480d11d920e9e5
-
SHA256
53c46a3f650e903192f0b094b3f063a8d3459713d80cfc2f2af5b389c165e76e
-
SHA512
25a6b0c9c971941d8e09a888a977048b9bb60b26c440b271c4101b0c6305339ff576294e0e4ebc0d1dac640deb70967528af7c91cf7a95c1d2afd09188fa7995
-
SSDEEP
98304:RZ+geGajn0awMkSFqN6Dfy/UI+nhtf7QM4FSoD+zLRSMeu/IuFwAKLPND3Pdr1zf:RZ+gWjfnj0Ajy/mt1oYdPIuFwDBD3Vhf
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 2 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 5 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.qiyi.video1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.7MB
MD517bf082d9e9a6eb8b5d62d82f4af5476
SHA1a401c7fbd8feea319dbcece5b4b3f6a254e71fb3
SHA2564df590b764f65c16b51176ff394458d0b3a866ca75a4f912d6f76b7793043c1c
SHA512f1a2673bf5c478176de0fceec8419434ab0606a14343c3b7fe1e2b181b0a2ff8f00c888ea1dcb8e711c4eb14aa1294919440adc63ce7735a67e93da21a0f7ae7
-
Filesize
395KB
MD52f737c10c13ddf1f3fe95054827891ca
SHA139233441365dbb7da364b4e75912f80e3b3abca5
SHA2564214986fc39f65f743d77a4df6c79e12b969f173efc88ede281dd9b33c55d0df
SHA51249907944fbc14692bba4587693cf2f9b1bbc9723b5e48fb641b6fde7f4cfe0f5813d3231d204a774fa3333ce7deb411fa0cbb33382e04bdc70791f4d9de436ba
-
Filesize
429KB
MD5ef9180f2d6baa6c7214403ec8f3b7ec5
SHA10da13630b0c13810bcea946dd88ec66774fcd502
SHA256e56c2ca20f560f0c18610d592394f6aeae28a5838d03c7bcbcc5904a56b8e04b
SHA512aa76abfe5d0d76ce1630d99b0b1ed133e782d30725169c9090529ac93c81251389a68153299013aa7a89af0d0430475d52310b7639ca048cb1cc516fa8ce879a
-
Filesize
2.0MB
MD5dd7a0c8ade494523b9f57371533f6f3d
SHA1cd6f7f8a0efbd76286d88207ba820adbf3b6adb3
SHA256c601c0334ba5ebb03111b9d7290a677d094f1b90c6489d541f1845d25074f15f
SHA5121ffd65dcc4eba1b6dd9f78daf6d921da2759844b1e2096716cd0404f11db6d511c8ead4e161ab637aab6ba21b70cd588db2d6c772b2800a400a1abad138ae0a9
-
Filesize
926KB
MD5ae3c908e2a57ff0fc9d3b82f5d9787a0
SHA11e6dfff7b2617d03d9d667999720d91f99153896
SHA2564775ab30db23a37f1c7402e9f43d2ab222dcd6468f549266ae5289757ba0bce6
SHA512ba74eaf029ce14ec984be6babe5127e1cbd5761f1ba3f83f9510678dc1a08295e072ded7cfd83e13778219804dfd16286f75518bdaf7495172b074d7c2d12f53
-
Filesize
2.0MB
MD5dd7a0c8ade494523b9f57371533f6f3d
SHA1cd6f7f8a0efbd76286d88207ba820adbf3b6adb3
SHA256c601c0334ba5ebb03111b9d7290a677d094f1b90c6489d541f1845d25074f15f
SHA5121ffd65dcc4eba1b6dd9f78daf6d921da2759844b1e2096716cd0404f11db6d511c8ead4e161ab637aab6ba21b70cd588db2d6c772b2800a400a1abad138ae0a9