flytrap | 98d5c2b0894893996a245091227072a9167d67c7ebac754ad14436b0f0723753

Analysis

max time kernel
2460658s
max time network
141s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
20/12/2023, 08:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98d5c2b0894893996a245091227072a9167d67c7ebac754ad14436b0f0723753.apk
Size 29.5MB
Sample231220-kv8npaggb3
SHA256 98d5c2b0894893996a245091227072a9167d67c7ebac754ad14436b0f0723753
MD5 cef941c5639ac9b0f475449986055b4a
SHA1 dc66dc9381f96c11080cdc1381555d035b81dad3
SHA512 67afb2580335f2d03dd4aa5ede472def8567e089a32305141663126612b3e1583b7de59fc1e42b8bdc5d222ccf35779985e97a9a7666cf9c48a8932cc639c3a3
SSDEEP 786432:0zDmz4jMaBAT3SU0qphE+bbBeCP6TqQMGpZYUsrqjSJ:0zDu4jxm3wj+b16sRJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

flytrap infostealer trojan

Malware Config

Signatures

FlyTrap
FlyTrap is part of a trojan campaign traced back to March 2021 that employs social engineering tricks to compromise Facebook accounts.
trojan infostealer flytrap

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.fkxfk.bd.mt/[email protected]	4626	com.fkxfk.bd.mt
/data/user/0/com.fkxfk.bd.mt/[email protected]!classes2.dex	4626	com.fkxfk.bd.mt

com.fkxfk.bd.mt
1⤵
- Loads dropped Dex/Jar
PID:4626

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

.jg.di

Path /data/data/com.fkxfk.bd.mt/files/.jglogs/.jg.di
Size 340B
SHA256 5d9639fdb2fda5f5674cd4d10174af41216e34273ace977d037ff21d5d6b1666
MD5 f9ef291d1a4cd3c39b7e42e43a270529
SHA1 268a66d976bea4bb6e40c43809b0648e85d78234
SHA512 e42a002a206f86f558d93ef805b486130bc0b7ff4cc463b868dee4604a6db59aaecef02a32376589009869a5fc67c32b5fcf8e6370784e5715c2fa1e39a9789c
MD5 SHA1 SHA512

Submit Download

.jg.ri

Path /data/data/com.fkxfk.bd.mt/files/.jglogs/.jg.ri
Size 314B
SHA256 56f2c1feb84ef075fb206572218ab795110da30f7c15b2782d0aac4f3193f3b4
MD5 54b8b5b41f92ef664ff69846252061a6
SHA1 c390f57a72bbc1459afe6576cf3f0f7bd3090de2
SHA512 286bf89354928303f73f0533eb25c81b205351ab80d4d379f22e006ce3cc7d5e38c97d720e95ee77c5407caa86429fc7c839db82c7aed7e96cde0ec48f8bb8ba
MD5 SHA1 SHA512

Submit Download

.jiagu.lock

Path /data/data/com.fkxfk.bd.mt/files/.jiagu.lock
Size 27B
SHA256 5360a17f885a55fb4c224d6f9b7bd90251a5a488fd7e48b2605d0672df7b1dbe
MD5 7887d49aa2d3bbaca20a113fd3dcfa8f
SHA1 21628ab53f67c9db32ae038afcb1f6362ec3428d
SHA512 c82ca20d50ea0249af58f299b440b2014b464b18482f9a6115e97b77cdeb030b0f91fe04ba55dcf44d9083624e8307123530f9ec5359dd1eb8b0898fc9492ac3
MD5 SHA1 SHA512

Submit Download

classes.dex

Path /data/user/0/com.fkxfk.bd.mt/.jiagu/classes.dex
Size 4.1MB
SHA256 c2975823dcc9f27ab4e3c21c7af48e2fcdaf132658b7098e7d4e7bebcfa272f2
MD5 e3650546a26f5eb75a02635c78b5c0f7
SHA1 c8277b079ab48f31af27ffe65312c53209fdb000
SHA512 17bd08ef2df6b73f3419efcfa5d1bbd5e262b759dd19a41c8d2f08c18cf2859f2138e67b5ef385dab5d7b32d48b21a73c79ccaeb9ba54cac042c002d738c3a66
SSDEEP 98304:iXuG1aWgd05v9HB1TXZajG9sTxXrm+ND6F:91dYrzZWG9GPi
MD5 SHA1 SHA512 SSDEEP

Submit Download

libjiagu.so

Path /data/user/0/com.fkxfk.bd.mt/.jiagu/libjiagu.so
Size 455KB
SHA256 78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e
MD5 e5a53000766ebc433b27d6a66ec4f555
SHA1 2c8f53f1c03aec2005bcad67d731f07261dabde0
SHA512 370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d
SSDEEP 12288:XfCZt8eDxO+LCDA89hC2KL/MqEvnapbMt6hVPZWJ:Xfw/O0Cc8zCD/MVvUHnRWJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

[email protected]

Path /data/user/0/com.fkxfk.bd.mt/[email protected]
Size 5.9MB
SHA256 be62456132857e5ef75f4c6c87513312f19ee3f2b915029a8adf29d5e44002bb
MD5 f3f3aaa1773d19c2091bc5fbdf331761
SHA1 6e3a55606fb2568207790c01db2efd061abce5df
SHA512 ab9b350dfc724c9e58307f94f71ac2a4570629d2f0ab029f9c55c278fc3dcd7437923cfa1139c679c17f85a49cb35219e314ee959e261280c1fb9466a8683472
SSDEEP 49152:ZRZuGM3bKhjAtxK62MVISG3LTDGykIZMEQqBGzKQPQGjUW2dB2KdxkTq3nZOgT5b:ZZabKhjiK62XJXIUjB1TXZaw
MD5 SHA1 SHA512 SSDEEP

Download

[email protected]!classes2.dex

Path /data/user/0/com.fkxfk.bd.mt/[email protected]!classes2.dex
Size 3.3MB
SHA256 70de52febb05b16d57540cef55ce6dc6dc163f0c77b9b85fe8cc3135561c358c
MD5 bf455e5e60ccbeafad2048158346e53d
SHA1 e9c8159bf277a0c9b31eb7d3cdefcb160b416d37
SHA512 62edf118ac6788fe5e933c764b2c43c021e98aa372d2142208327ebf29988f9fca7783c465f4cd64f2a1719b3b2c59f8d89614fcfe75abaa8fd4ed8a64374a46
SSDEEP 49152:b2G78RZ5XM6881icznjzBRWLZyH88IH+0kKLPyEe+V:b2GgG0fBRYE+V
MD5 SHA1 SHA512 SSDEEP

Download

.deviceId

Path /storage/emulated/0/360/.deviceId
Size 48B
SHA256 36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731
MD5 4c4c5285293d5141f582aefa4e038669
SHA1 e01852a72e5a8e6f7d63a21426b515118196047b
SHA512 097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399
MD5 SHA1 SHA512

Submit Download

.iddata

Path /storage/emulated/0/360/.iddata
Size 32B
SHA256 c22086acbf829b6e4645ec21633a561a7dccf86a48ffe28b8f9a21c87df4ec6e
MD5 c470cd4a08b8729d75ac755e3015a1eb
SHA1 0164c82701b408248c1f118db35f98bee56ea74f
SHA512 38287edca23e463aa47b5d1c390a9dba1d66a85bdea1ae99a74c914543181c986cd8a5500a4372104455983e6368d2e1f0a18bf5ed7586f06ddf26de37a28850
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads