Analysis
-
max time kernel
2417856s -
max time network
161s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 06:43
General
-
Target
8c9d7345935d46c1602936934b600bb55fa6127cbdefd343ad5ebf03114dbe45.apk
-
Size
5.5MB
-
MD5
90960e63a4d5a871f2f5617f6e26c382
-
SHA1
efe3f8785f17d1add3642a2607ef346ea9bbf962
-
SHA256
8c9d7345935d46c1602936934b600bb55fa6127cbdefd343ad5ebf03114dbe45
-
SHA512
b781b2a3882bbf2a86c6759be88a69a9260363f5d47c1da963946bf0d82c86de30edd1ca6b05f861aa4e828f5d0ff0e8a7b71b931ce00f031244b59be1d323bd
-
SSDEEP
98304:2x2natN0Gwuybg0chHxA/PfECifHyUiCAnBT7rXxrZSFES2PHsQMnZvgnfe3W3S7:2x9735ypcJxA/oLArFSqPHsQMAe3P7
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.snda.wifilocating1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.1MB
MD52523224ea72332eda17242335b1d5965
SHA1e469987188975bad5210ea409a72af509aeafd4a
SHA256ac1b9c1381fd71afedf0b8421bc173f9f9b4646233df94ff4f96643f0d75618d
SHA5122947d2f841ab99ed860bce89c92d17f101e1bb62b787554fa7044bf81a807e37930ebed16fcfddb9ecf633e34769576245a770de7eae6254f262dfbc2c206522