flubot_v4[.]9-3_9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9-first[.]apk

General

Target
flubot_v4.9-3_9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9-first.apk
Size 5.0MB
Sample260219-neebpadt5g
SHA256 9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9
MD5 e6625c1492caa11ac4ea8e7039c423a2
SHA1 665cf567a24989208fb95b64f73a743f3b4f2470
SHA512 1e1df3c6b44acfb53b69e6b637a3524cad7ebc7d74f9d263de2f611ae1270f6ba5075eac494f5c2e57d1d230ab5b9f584265e18b46abbef9fcaf0674f166494e
SSDEEP 98304:qKr9rpz0mtVL4JV0O2XcYZDgPvlmDPdMpaBOdrDrXRjNG5q3W3f1As7eIwUEqRo:qKrFZtVLCb2Xd+PdmDVZBkJGk3Ts7e/9
TLSH
T197362329FE9EE196E10BD432E226E54785080059361CF92F1F26C68D6DBBC409B47FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
flubot_v4.9-3_9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9-first.apk

File Explorer

flubot_v4.9-3_9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9-first.apk

.apk 5.0MB

flubot_v4.9-3_9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9-first.apk

SHA256 9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9
MD5 e6625c1492caa11ac4ea8e7039c423a2
SHA1 665cf567a24989208fb95b64f73a743f3b4f2470
SHA512 1e1df3c6b44acfb53b69e6b637a3524cad7ebc7d74f9d263de2f611ae1270f6ba5075eac494f5c2e57d1d230ab5b9f584265e18b46abbef9fcaf0674f166494e
SSDEEP 98304:qKr9rpz0mtVL4JV0O2XcYZDgPvlmDPdMpaBOdrDrXRjNG5q3W3f1As7eIwUEqRo:qKrFZtVLCb2Xd+PdmDVZBkJGk3Ts7e/9
TLSH
T197362329FE9EE196E10BD432E226E54785080059361CF92F1F26C68D6DBBC409B47FDE
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

31bec91f402620ce6752b5f55d886a15d0730b408023c880232693b5ebb4c3e6

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.snda.wifilocating

Android Permissions

flubot_v4.9-3_9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9-first.apk

Permissions

android.permission.CALL_PHONE

android.permission.SEND_SMS

android.permission.READ_PHONE_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.WRITE_SMS

android.permission.RECEIVE_SMS

android.permission.VIBRATE

android.permission.READ_CONTACTS

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.INTERNET

android.permission.FOREGROUND_SERVICE

android.permission.READ_SMS

android.permission.QUERY_ALL_PACKAGES

android.permission.WAKE_LOCK

android.permission.REQUEST_DELETE_PACKAGES

flubot_v4.9-3_9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9-first.apk

File Signature issue

com.snda.wifilocating.p8c3b1442

com.snda.wifilocating.pa7640c99

com.snda.wifilocating.p23cf5803

com.snda.wifilocating.p36ade4fc

com.snda.wifilocating.pf8d7792c

com.snda.wifilocating.p91de6dcf

com.snda.wifilocating.p8d88398a

com.snda.wifilocating.pd3135592

com.snda.wifilocating.pbd40fb83

com.snda.wifilocating.p004fa17a

com.snda.wifilocating.pd8fa385f

com.snda.wifilocating.pdfe6257e

Sharing

General

Malware Config

Signatures

File Explorer

flubot_v4.9-3_9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9-first.apk

File Signature issue

com.snda.wifilocating.p8c3b1442

com.snda.wifilocating.pa7640c99

com.snda.wifilocating.p23cf5803

com.snda.wifilocating.p36ade4fc

com.snda.wifilocating.pf8d7792c

com.snda.wifilocating.p91de6dcf

com.snda.wifilocating.p8d88398a

com.snda.wifilocating.pd3135592

com.snda.wifilocating.pbd40fb83

com.snda.wifilocating.p004fa17a

com.snda.wifilocating.pd8fa385f

com.snda.wifilocating.pdfe6257e

Android Permissions

flubot_v4.9-3_9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9-first.apk