Analysis
-
max time kernel
4031270s -
max time network
164s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
09-01-2024 22:04
General
-
Target
0f63caf808e459b8bf4da9355048ff3bdc47b03de2ceceeb813e494aa738c0f1.apk
-
Size
3.4MB
-
MD5
19a78be812d33fd3c0d57241763950df
-
SHA1
f47d6e3a31594424279429536551cd289b4be392
-
SHA256
0f63caf808e459b8bf4da9355048ff3bdc47b03de2ceceeb813e494aa738c0f1
-
SHA512
60a3d8614a7897aa83f2874a9e39c58e055e6e3f680175c77314a0377cbb492dc862fca77b3d8ee287fafef88692c64ad42cb223418c36b9288ac22dcc020391
-
SSDEEP
98304:DKidS+0YvujZRFJJAC7/B7KAQbS5hX4tNyu:/Szj7FJvZ7lQ0p4tNb
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 2 IoCs
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5b97b4d8058dff9102a8346ef1e670abd
SHA13c5229fe1aa85870bc3ca54df536bb388055d523
SHA25635ec7d8be3e0c43a5abd06ca5e9c99571a237ae7833a882aae550811565432b4
SHA512dbdaea52c19023d2ec0b65703326af1fd21b38b5314c434300760dafebf9c05c30338b8d109187b10d558c089d3e33a0b2672dc75e632531f2749accdca29a77
-
Filesize
1.5MB
MD584bd7e9703c148c04dc0819da6f0fe49
SHA12f05e1251da72e6205d0c024458dd577e9605ad1
SHA2568c46b81104dc577ff09389cdb4bdc2692e067c5f11ab346b7bcfac4668476f08
SHA512ee1cde4cdc925fde101f0ea5e15b6f81fa63ab9b006836a3e699b67b91aa34f797849f45e482267c2f6c1ed53a90ae9c3c6b6aafbaecebafecb40dcf0b6b2f50