Analysis
-
max time kernel
150s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
25-02-2024 22:03
General
-
Target
39c7ad6f0f5bea15001dfa01c337a9db44de0582d41bda87d5507c3bf453d73c.apk
-
Size
3.3MB
-
MD5
ba633174df329bbb08e12a8c74203306
-
SHA1
de6b3f2a977aeaaecf335de60d390056ed8d24ab
-
SHA256
39c7ad6f0f5bea15001dfa01c337a9db44de0582d41bda87d5507c3bf453d73c
-
SHA512
30f780c531ae0431c05dbe17a86fba86c8b42c479381b70cb95c777ef7a312deb50270d8db721ab475df2b2334459f87e2223406e328132887c92e56d9f4d477
-
SSDEEP
98304:YTEk6iXsxRB912taAW1CFUdl+D32whoFQO/G6:YYkyRBWDW1IUdl+7hKe6
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 3 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.eg.android.AlipayGphone1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5c2919267fd8127813e2a6379b357a46d
SHA132579da94dd1af00f1116b51e4f4d4869c2f3266
SHA256c3e58a3bbdc36b791e964346405015d83aadf33d28bffd82c5c6f1c17fc17184
SHA512ecd0a2fb037d0dd22dcf442ca2ac16e777bede5f25c109f4d4d7effea90740b3d292b9aba23677439a824d8abb8610c8fad8a1286e8cdcac9b6acbb875434cbb
-
Filesize
87KB
MD5d93ae64ce5dae192a1f381ddfc38a0f5
SHA19bbcc299fe9439b7ffa85d08a8f7faf853406381
SHA256cb40ae9089eb689b3e99904335b5187c33b230b54c4c5dc04e9e0786ae5b50cd
SHA512af5fb1458a3100228cadc52dfed3d089f02d68d5dfad40673cecf4df926cb27f94845ea4f38271c6ea9b4367f712143c0726a4b0c6cb661aa3d740ab0b22f770
-
Filesize
49KB
MD548e6b9f8ced4f8ca7eb148fc0cbeef33
SHA1a07e4cc98d9cc31233cafe64b1b2eaa31942bd37
SHA2563034bcc84a97474dd503155cf30031df1297a7557fbcdfe33ab293353c8647f6
SHA51205a45feab2e67a5271024fc01f6c17a65d440aec021e73710cb9196e1e461048b3d7e5aac00a2635e2aec38d3146cd45fc9a9919f689398a9c3b0e67b67eb6a3
-
Filesize
120KB
MD5c384c5cdaf8f3edfa29389f2de2effea
SHA15e5dad9692cf5794e3ff7b99a64e6555399bc56f
SHA2560f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062
SHA5127ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780