flubot_v5[.]3_e9ff37663a8c6b4cf824fa65a018c739a0a640a2b394954a25686927f69a0dd4[.]apk

General

Target
flubot_v5.3_e9ff37663a8c6b4cf824fa65a018c739a0a640a2b394954a25686927f69a0dd4.apk
Size 5.5MB
Sample260219-nsa67ady3h
SHA256 e9ff37663a8c6b4cf824fa65a018c739a0a640a2b394954a25686927f69a0dd4
MD5 a4e52ac69d698f7e483dfc3620d3f11f
SHA1 762b09ace083dc88ee76dbbac8447d637cbe08d3
SHA512 78fbae91eecde88a9f608f32cf04d0685f6932c4a03950b01974352e0f0c45366008d02cfe2b7a2fa08d231cc9c921c52f465b18f9225b61e6cde9057afdbd73
SSDEEP 98304:1fKRKdQfY85MrPTXnWk6bx7j9H6AiwTXl5DGS5D/F9yxrC0:1f1dQf9k0x9apwzbRD/F9yNC0
TLSH
T10E46231ABE9EE02BE483E935C068C58B840C40CD5715FB5B7769814C4EB6D84AB87FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
flubot_v5.3_e9ff37663a8c6b4cf824fa65a018c739a0a640a2b394954a25686927f69a0dd4.apk

File Explorer

flubot_v5.3_e9ff37663a8c6b4cf824fa65a018c739a0a640a2b394954a25686927f69a0dd4.apk

.apk 5.5MB

flubot_v5.3_e9ff37663a8c6b4cf824fa65a018c739a0a640a2b394954a25686927f69a0dd4.apk

SHA256 e9ff37663a8c6b4cf824fa65a018c739a0a640a2b394954a25686927f69a0dd4
MD5 a4e52ac69d698f7e483dfc3620d3f11f
SHA1 762b09ace083dc88ee76dbbac8447d637cbe08d3
SHA512 78fbae91eecde88a9f608f32cf04d0685f6932c4a03950b01974352e0f0c45366008d02cfe2b7a2fa08d231cc9c921c52f465b18f9225b61e6cde9057afdbd73
SSDEEP 98304:1fKRKdQfY85MrPTXnWk6bx7j9H6AiwTXl5DGS5D/F9yxrC0:1f1dQf9k0x9apwzbRD/F9yNC0
TLSH
T10E46231ABE9EE02BE483E935C068C58B840C40CD5715FB5B7769814C4EB6D84AB87FDE
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

137cac7ded401e74d8f2241914104e7d691a22f28c53fe1f2489eabcbe5f75d6

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.tencent.mobileqq

Android Permissions

flubot_v5.3_e9ff37663a8c6b4cf824fa65a018c739a0a640a2b394954a25686927f69a0dd4.apk

Permissions

android.permission.CALL_PHONE

android.permission.SEND_SMS

android.permission.READ_PHONE_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.WRITE_SMS

android.permission.RECEIVE_SMS

android.permission.VIBRATE

android.permission.READ_CONTACTS

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.INTERNET

android.permission.FOREGROUND_SERVICE

android.permission.READ_SMS

android.permission.QUERY_ALL_PACKAGES

android.permission.WAKE_LOCK

android.permission.REQUEST_DELETE_PACKAGES

flubot_v5.3_e9ff37663a8c6b4cf824fa65a018c739a0a640a2b394954a25686927f69a0dd4.apk

File Signature issue

com.tencent.mobileqq.p2233a621

com.tencent.mobileqq.p1279eff1

com.tencent.mobileqq.pce61c919

com.tencent.mobileqq.pf7530df8

com.tencent.mobileqq.p71b32960

com.tencent.mobileqq.p9dfaf6e3

com.tencent.mobileqq.p7de4e8b7

com.tencent.mobileqq.pcdf91408

com.tencent.mobileqq.pc4f2eab5

com.tencent.mobileqq.pc27d0693

com.tencent.mobileqq.p57216304

com.tencent.mobileqq.pc64bacb2

Sharing

General

Malware Config

Signatures

File Explorer

flubot_v5.3_e9ff37663a8c6b4cf824fa65a018c739a0a640a2b394954a25686927f69a0dd4.apk

File Signature issue

com.tencent.mobileqq.p2233a621

com.tencent.mobileqq.p1279eff1

com.tencent.mobileqq.pce61c919

com.tencent.mobileqq.pf7530df8

com.tencent.mobileqq.p71b32960

com.tencent.mobileqq.p9dfaf6e3

com.tencent.mobileqq.p7de4e8b7

com.tencent.mobileqq.pcdf91408

com.tencent.mobileqq.pc4f2eab5

com.tencent.mobileqq.pc27d0693

com.tencent.mobileqq.p57216304

com.tencent.mobileqq.pc64bacb2

Android Permissions

flubot_v5.3_e9ff37663a8c6b4cf824fa65a018c739a0a640a2b394954a25686927f69a0dd4.apk