Analysis
-
max time kernel
150s -
max time network
161s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
02-04-2024 09:39
General
-
Target
891d5d2c397e9ad5fed5685f78657d4b_JaffaCakes118.apk
-
Size
4.6MB
-
MD5
891d5d2c397e9ad5fed5685f78657d4b
-
SHA1
f2f3f6344e054a03cd83e2e2f00af2af3d59f1c5
-
SHA256
ea6776fac45c8844242fdb566a17e70569813298235567bbe9fa0dd062f1160b
-
SHA512
369875e4359b91936f015d347be0f765ffdfddb92c82d887d3cbe07c38dacc0029b25f38682f270700feaa62d728ccf42ccd95362785f7c2119ae43e74d2ac49
-
SSDEEP
98304:UHIuiDQ9wfSVdDp6gDkTjhJfB5oxlAuEk0Olk0mYjFpfYgQ+Q67D2t:Uor4pVZp6PjbfskXX+3PQd67O
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Makes use of the framework's Accessibility service 2 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.moxiu.launcher1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5bccc264f54ba87ac50aadbdc9b6c1669
SHA1a926c3ffab368d1f594f2169afa9317d3ba73e5a
SHA256455d1801f96be1258b08a548b59ebf7d37d76cd96c05313e192779b1343d4853
SHA5126e252ae6a0f5dbf11e18e1af778b426406dfe09c61b7ad638f783eb0805b3adeab75ad0e1458dfdc52fd0f73f17f8087604a5ff3ffa0e9f02cc8367b8fddc125
-
Filesize
859KB
MD5804b266d166b49f270e0d9a24d4cc9db
SHA10388e3e58078eef9833082f7d51b9f579465ef38
SHA256f28fbfa82ab5412488c57471945f3421d59efaa01181444f9b28eb289f8bd65a
SHA512fdfcc30fb86c3746bee440cb28b8264ab9f116445a5ddc4b64d63ed59a42f9aea87bbca688692d8f3c93f01db2569d27905b504529d023c838c69d7d626d591e