Resubmissions
10/12/2023, 03:07
231210-dmancsdcf71010/12/2023, 01:55
231210-cb476abdfr1010/12/2023, 01:24
231210-bsmh1acgf71010/12/2023, 01:17
231210-bnjasabbgp10Analysis
- max time kernel
1370640s - max time network
159s - platform
android_x64 - resource
android-x64-20231023.1-en - resource tags
androidarch:x64arch:x86image:android-x64-20231023.1-enlocale:en-usos:android-10-x64system - submitted
10/12/2023, 03:07
Behavioral task
behavioral1
Sample
15328ea6d31bef8ddd15a81e0f5a549b.apk
Resource
android-x86-arm-20231023-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
15328ea6d31bef8ddd15a81e0f5a549b.apk
Resource
android-x64-20231023.1-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
15328ea6d31bef8ddd15a81e0f5a549b.apk
Resource
android-x64-arm64-20231023-en
7 signatures
150 seconds
General
- Target 15328ea6d31bef8ddd15a81e0f5a549b.apk
- Size 3.3MB
- Sample231210-dmancsdcf7
- SHA256 a778818cc08d213d1f66db5fa8b34aabc862569ecb99fd1aea37ff6ccab48400
- MD5 15328ea6d31bef8ddd15a81e0f5a549b
- SHA1 c52f12651d91a9bf0d625a879b34d194eba69ed4
- SHA512 5939a527d289315ff6d354bbd6e834ae9b3f452aebc54114a0fb46cb5422e5537ff0592aa62fbd20d753162f6a3ae56cfd97c4320613d1377a9b5a7d6a525336
- SSDEEP 49152:qLzu436uB6iejEyNRe1kqqGI18iNwDelhcTUr4T1S0NwBbGJ3H5+ELr42SKn2IQI:qHuKB6BzReWqqGWNN8g4ETBaJ7n2Izl
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- FluBot
FluBot is an android banking trojan that uses overlays.
- FluBot payload 3 IoCs
resource yara_rule behavioral2/files/fstream-1.dat family_flubot behavioral2/memory/5059-0.dex family_flubot behavioral2/memory/5059-1.dex family_flubot - Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.sina.weibo Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.sina.weibo Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.sina.weibo - Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.sina.weibo/app_apkprotector_dex/Zw6IGlco.ppt 5059 com.sina.weibo /data/user/0/com.sina.weibo/app_apkprotector_dex/Zw6IGlco.ppt 5059 com.sina.weibo
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.sina.weibo/app_apkprotector_dex/Zw6IGlco.ppt
- Size 2.3MB
- SHA256 51a29d7ced99b68bf97e8dfff99f3a99aa157c7e6f86161e83935f750c5c73d3
- MD5 44e5099c255320beb84c347c28d9ffba
- SHA1 32bccc9ebf25868ac299f14f45da44e166f424f1
- SHA512 4efcbd07e80007e6b2c178c203a218cdcdba2c58347010485148e237aa4bc4b6a8c9aa2b53a9907b430349a1643e5e262e4049541dbab09a171b4f0ce73a9d88
- SSDEEP 24576:omxbGYtoquPmBbSflT+Yaz3PgXA5g/ZCiy36C8PML:omxbaV0VzsX0uC8Pc
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.sina.weibo/app_apkprotector_dex/Zw6IGlco.ppt
- Size 2.3MB
- SHA256 51a29d7ced99b68bf97e8dfff99f3a99aa157c7e6f86161e83935f750c5c73d3
- MD5 44e5099c255320beb84c347c28d9ffba
- SHA1 32bccc9ebf25868ac299f14f45da44e166f424f1
- SHA512 4efcbd07e80007e6b2c178c203a218cdcdba2c58347010485148e237aa4bc4b6a8c9aa2b53a9907b430349a1643e5e262e4049541dbab09a171b4f0ce73a9d88
- SSDEEP 24576:omxbGYtoquPmBbSflT+Yaz3PgXA5g/ZCiy36C8PML:omxbaV0VzsX0uC8Pc
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.sina.weibo/app_apkprotector_dex/Zw6IGlco.ppt
- Size 2.3MB
- SHA256 51a29d7ced99b68bf97e8dfff99f3a99aa157c7e6f86161e83935f750c5c73d3
- MD5 44e5099c255320beb84c347c28d9ffba
- SHA1 32bccc9ebf25868ac299f14f45da44e166f424f1
- SHA512 4efcbd07e80007e6b2c178c203a218cdcdba2c58347010485148e237aa4bc4b6a8c9aa2b53a9907b430349a1643e5e262e4049541dbab09a171b4f0ce73a9d88
- SSDEEP 24576:omxbGYtoquPmBbSflT+Yaz3PgXA5g/ZCiy36C8PML:omxbaV0VzsX0uC8Pc
- MD5 SHA1 SHA512 SSDEEP