Analysis
-
max time kernel
2352453s -
max time network
159s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
20-12-2023 04:50
General
-
Target
854c30bf0c1a28a885f961428f462241a2aaa3f3977433385ff9e2291e1cf0b8.apk
-
Size
5.8MB
-
MD5
5f13277525cd49fe9faadb4991c3e184
-
SHA1
bc846998b592dc71c19a20fcdde0bdf4e208f5e9
-
SHA256
854c30bf0c1a28a885f961428f462241a2aaa3f3977433385ff9e2291e1cf0b8
-
SHA512
c7c105ea03b5a968a5b592b8132c080c04bfba5c930cabd90aee84108b6672c603ee3e291dec0942eeb36db1b859ccce84bd0d28fb1edb5a55968a23ccaeaa8d
-
SSDEEP
98304:IevZEuKg3P8VajEu2XrsfdLppLe819z8KeJvcBvzatt102faYx6/4KTNEY4htwln:IOK3HQpToKCIz6102faY4j+3ax
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 5 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.iqiyi.i18n1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
421KB
MD58345c73b46814e1384ff8462248b23af
SHA14d9a4db4c7cf0a19d041d9191cef90df5d186aad
SHA25632fbfe031ecde2df1f5427303b61eb84492d3edf22d6a133b002a00bba7c1439
SHA5125895dbad205eb6a72516745f18d1ad49cdfde4eaa197df752447e488fe976f91eba305499bd8b6abc5c9746b90f377b669a583104b20d5d8bc33fd5bf0b23d74
-
Filesize
4.7MB
MD57e343cbc45b618d05182d74bd61826b2
SHA102ee96263b3b967e570e8ddb1fa36cb21032b71b
SHA256324b5af2ec2d78bb57b1552f429af51ac8d65f7fa277217ae8d4371ab14178d1
SHA51248cbd8a5b246cf9d6ec16558ab12af131439837094c63a64046de384da933593459fb1aec126393bbe3b2b8ca19437f38b68364c9f158023a7b1a35e6901c705
-
Filesize
396KB
MD5b93f8047ed660629c2efe0aef2bbe0e4
SHA17c63d6781b3f4e3ebecea0eabd707a9ffdbaa774
SHA256b6c05e60710e14ce7e7d02cfca7230d6251217374e465aaaca845426017ea89b
SHA5123a150d1227d123454018eeb232131b25d251277edbaa4e53c059499d9febf15eec429e0c419d9aa7bf5de212c86209e97a15560469b6322ec3c404d431b71e0e
-
Filesize
348KB
MD57cc73db948d4bd632c48414ec93599a7
SHA1f1b95a6b99e7e964c21da365759c8c31b0c90ec2
SHA2564e128ea4e5e42dd84ca017d70513e94d5caa3d0c77d5f2d9dc9b05c54a9e33f5
SHA5124d19f2fb55bb855ed8780ab68ecf4539b8618b627e1c171d6d14fa7c7be3b034a7e2c53c1d19b79a9aa14c14420b7f1348df58ccc74944eedccb3145f6b0084e
-
Filesize
2.0MB
MD5f48776ce37adf12d6ed3fda02a4cd6d1
SHA195c55f2ec968ab7b1620e051470e5fe2f6acc1a7
SHA256ff3bf5928658844579c835a6129e5270690b195d2906730e7ac587ef9ce151fb
SHA512538b44e966635aa58cb1e82ccb727195c19a49920b212895d1ee0d598f6b6f176619b44937eafd016cdabc1b7645561d6f884641a8e709ebcee2722ba77ecb05