Analysis
-
max time kernel
93s -
max time network
160s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
25-02-2024 22:03
General
-
Target
39c7ad6f0f5bea15001dfa01c337a9db44de0582d41bda87d5507c3bf453d73c.apk
-
Size
3.3MB
-
MD5
ba633174df329bbb08e12a8c74203306
-
SHA1
de6b3f2a977aeaaecf335de60d390056ed8d24ab
-
SHA256
39c7ad6f0f5bea15001dfa01c337a9db44de0582d41bda87d5507c3bf453d73c
-
SHA512
30f780c531ae0431c05dbe17a86fba86c8b42c479381b70cb95c777ef7a312deb50270d8db721ab475df2b2334459f87e2223406e328132887c92e56d9f4d477
-
SSDEEP
98304:YTEk6iXsxRB912taAW1CFUdl+D32whoFQO/G6:YYkyRBWDW1IUdl+7hKe6
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.eg.android.AlipayGphone1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5ea64bf4bb35827ee94b3d25c237f9d6f
SHA195606787c3573357816eba7a53f9742fc59eb35e
SHA25649113cb61a03477c7a8bb60faf32ed8fdbaf16cd6c440fef288ed5a49e471934
SHA512e46e871b6235ce035ffd43b0094c547ed343994b40ea88f48fb0383649c2b149d3dc40caef6905c175f2f26137b355399f11ae29e12d46668b6b8293e8f249f7
-
Filesize
15KB
MD5ea734e0f5e8fd32ad99817d38df8fdab
SHA10a39eb15470f10dc2db5b9ce3660f049f3e0525d
SHA256f8ab0fcb2e10c7da8ef84ba97447e1a26a1454697361b654b34987910e56eb0f
SHA51232b9566c6a69bd5917aa88807eb2e7971fd63049c2eb2245070bffab5609af386b7df8219185cda0c449fe3a863e46e2f422dfd7895c5a718f35cae25983461d
-
Filesize
120KB
MD5c384c5cdaf8f3edfa29389f2de2effea
SHA15e5dad9692cf5794e3ff7b99a64e6555399bc56f
SHA2560f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062
SHA5127ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780