Analysis
-
max time kernel
2453880s -
max time network
159s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
20-12-2023 08:43
General
-
Target
97206706b5aa31cebb8ac30102632d3072bd00b1bc6d9a097db417974dca69a5.apk
-
Size
4.5MB
-
MD5
f9a79cb761afbb4315840408e14c5a6b
-
SHA1
f5e6549a76e9713f961fa9c7855b9cc9ffc5cf0a
-
SHA256
97206706b5aa31cebb8ac30102632d3072bd00b1bc6d9a097db417974dca69a5
-
SHA512
d9b92df7f9ae8c4d8f36c93f454c4df84b609aab94910bca73fdff7db673fbec2490ab38adb634c9006c7690c6064bf0c4edd4acf236add6f93d9f7fa99e9f7d
-
SSDEEP
98304:6ybtPX2a3eE3ldgwnvK6t9bVCNJd1IWTryoa:NbrOE3lqwnvKu9bVC3zIOm
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.snda.wifilocating1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD570703cbe1bae9d61929b2648d45cc01e
SHA109ec99de753bffe18edb59f6431fdda5bbee63f9
SHA25615270429fe30e23468aedf0809494d4505e1f467b48cca9ee3a8dc988c3ec471
SHA51253349c64a0642e36d3b8013b02f37ac084572dce0e287e954486329817410bbec7be3f5ebd58867216d23d02a322e4aabf76b839c195601ababf2c20c93199ac
-
Filesize
2.0MB
MD59434cbccb6f198c8fc7a953a87e60ae2
SHA1b038f32bedb4bc9dc42b6dd485d2634de990946d
SHA25665156785ca81e60ddf8bf16b745bce253d4cfc4c81373b01b0d5bc237f00618c
SHA512697803d0dc473fa78671d562d3f9c784d033cdaa2992ab7ed2aa08fa3a23a62409a1ad7ff6bd0ec3c47d9f64c2a40e9a6872e1d7ab244c19380e14aa2c8fad08