Analysis
-
max time kernel
2454145s -
max time network
161s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 08:43
General
-
Target
97206706b5aa31cebb8ac30102632d3072bd00b1bc6d9a097db417974dca69a5.apk
-
Size
4.5MB
-
MD5
f9a79cb761afbb4315840408e14c5a6b
-
SHA1
f5e6549a76e9713f961fa9c7855b9cc9ffc5cf0a
-
SHA256
97206706b5aa31cebb8ac30102632d3072bd00b1bc6d9a097db417974dca69a5
-
SHA512
d9b92df7f9ae8c4d8f36c93f454c4df84b609aab94910bca73fdff7db673fbec2490ab38adb634c9006c7690c6064bf0c4edd4acf236add6f93d9f7fa99e9f7d
-
SSDEEP
98304:6ybtPX2a3eE3ldgwnvK6t9bVCNJd1IWTryoa:NbrOE3lqwnvKu9bVC3zIOm
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.snda.wifilocating1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD59434cbccb6f198c8fc7a953a87e60ae2
SHA1b038f32bedb4bc9dc42b6dd485d2634de990946d
SHA25665156785ca81e60ddf8bf16b745bce253d4cfc4c81373b01b0d5bc237f00618c
SHA512697803d0dc473fa78671d562d3f9c784d033cdaa2992ab7ed2aa08fa3a23a62409a1ad7ff6bd0ec3c47d9f64c2a40e9a6872e1d7ab244c19380e14aa2c8fad08
-
Filesize
918KB
MD5acaaeecffab8c43a06447a050ee911d9
SHA1b53cedc288de06a04a7474c4d722ac8316621f3f
SHA2562134e70aaf069a62950bf7b857524700ee932712fd76bde78df32d170d978bda
SHA512199c235704c044a889bbac2b73ea9092663bde95cc100f5530159dee326112c331356fcc8c05e67f51260a66a8542850417f375ef198d39044e10b04c0a0b14f