Resubmissions

10/12/2023, 03:07

231210-dmancsdcf710

10/12/2023, 01:55

231210-cb476abdfr10

10/12/2023, 01:24

231210-bsmh1acgf710

10/12/2023, 01:17

231210-bnjasabbgp10

Analysis

  • max time kernel
    1370640s
  • max time network
    159s
  • platform
    android_x64
  • resource
    android-x64-20231023.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231023.1-enlocale:en-usos:android-10-x64system
  • submitted
    10/12/2023, 03:07

General

  • Target
    15328ea6d31bef8ddd15a81e0f5a549b.apk
  • Size 3.3MB
  • Sample231210-dmancsdcf7
  • SHA256 a778818cc08d213d1f66db5fa8b34aabc862569ecb99fd1aea37ff6ccab48400
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

  • FluBot payload 3 IoCs
  • Makes use of the framework's Accessibility service 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.sina.weibo
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    PID:5059

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Zw6IGlco.ppt

        • Path /data/data/com.sina.weibo/app_apkprotector_dex/Zw6IGlco.ppt
        • Size 2.3MB
        • SHA256 51a29d7ced99b68bf97e8dfff99f3a99aa157c7e6f86161e83935f750c5c73d3
        • MD5 SHA1 SHA512 SSDEEP

        Zw6IGlco.ppt

        • Path /data/user/0/com.sina.weibo/app_apkprotector_dex/Zw6IGlco.ppt
        • Size 2.3MB
        • SHA256 51a29d7ced99b68bf97e8dfff99f3a99aa157c7e6f86161e83935f750c5c73d3
        • MD5 SHA1 SHA512 SSDEEP

        Zw6IGlco.ppt

        • Path /data/user/0/com.sina.weibo/app_apkprotector_dex/Zw6IGlco.ppt
        • Size 2.3MB
        • SHA256 51a29d7ced99b68bf97e8dfff99f3a99aa157c7e6f86161e83935f750c5c73d3
        • MD5 SHA1 SHA512 SSDEEP