Analysis
-
max time kernel
2352461s -
max time network
162s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 04:50
General
-
Target
854c30bf0c1a28a885f961428f462241a2aaa3f3977433385ff9e2291e1cf0b8.apk
-
Size
5.8MB
-
MD5
5f13277525cd49fe9faadb4991c3e184
-
SHA1
bc846998b592dc71c19a20fcdde0bdf4e208f5e9
-
SHA256
854c30bf0c1a28a885f961428f462241a2aaa3f3977433385ff9e2291e1cf0b8
-
SHA512
c7c105ea03b5a968a5b592b8132c080c04bfba5c930cabd90aee84108b6672c603ee3e291dec0942eeb36db1b859ccce84bd0d28fb1edb5a55968a23ccaeaa8d
-
SSDEEP
98304:IevZEuKg3P8VajEu2XrsfdLppLe819z8KeJvcBvzatt102faYx6/4KTNEY4htwln:IOK3HQpToKCIz6102faY4j+3ax
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.iqiyi.i18n1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.7MB
MD517bf082d9e9a6eb8b5d62d82f4af5476
SHA1a401c7fbd8feea319dbcece5b4b3f6a254e71fb3
SHA2564df590b764f65c16b51176ff394458d0b3a866ca75a4f912d6f76b7793043c1c
SHA512f1a2673bf5c478176de0fceec8419434ab0606a14343c3b7fe1e2b181b0a2ff8f00c888ea1dcb8e711c4eb14aa1294919440adc63ce7735a67e93da21a0f7ae7
-
Filesize
2.0MB
MD5f48776ce37adf12d6ed3fda02a4cd6d1
SHA195c55f2ec968ab7b1620e051470e5fe2f6acc1a7
SHA256ff3bf5928658844579c835a6129e5270690b195d2906730e7ac587ef9ce151fb
SHA512538b44e966635aa58cb1e82ccb727195c19a49920b212895d1ee0d598f6b6f176619b44937eafd016cdabc1b7645561d6f884641a8e709ebcee2722ba77ecb05
-
Filesize
308KB
MD566e4bf26f8b9f79df73c709044317e26
SHA18a2699ab7686d92135c54fbe234e928da672d101
SHA2561fb1c877c7a8995ad9fc6fab35ff030ee13eaf61a9bb6f51e74b8335c3ba5449
SHA512eedbb33503d1a0b4efbb1461afdb7595eb6bf6d5ab11ab1b94bb9e91439fc7647626efc0e9f251687cafb71392f8e893430b7c63df3e8ac5c7864bfa9ed36f94