Analysis
-
max time kernel
179s -
max time network
194s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
20-07-2024 22:02
General
-
Target
f86ce60828d2fe6601b3b8c005ed543873ad6769409fc70cd1ecbe5357626f5b.apk
-
Size
4.1MB
-
MD5
4ee49e0bc3cde30139e9484d2ab73440
-
SHA1
7e67b11ef4820f8e70581b8c1d43c2b32063b297
-
SHA256
f86ce60828d2fe6601b3b8c005ed543873ad6769409fc70cd1ecbe5357626f5b
-
SHA512
954f6cc847e162b66131d90a0b44d9bd9aa5e1083a118bb707c8b6400342493e20e9c934ecbb7bb821a062b71fe61d8a8b1b66cb0bc702f69e236a70f7a44472
-
SSDEEP
98304:Dnc67bs9X7DFB2kNgRrQv0Ddnwyypk2Oxm96duI:Dnc6749XvOEqvuI
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
Processes
-
floor.hen.will1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD52d3ea038b6b12099d27ec3675655d55a
SHA171f94b12680be8fb627d7204218990800c279f60
SHA25651c4ee71fa4eaaf63cc733a5a3307b78dddc3a8fc1585d8f01b0fe686295333a
SHA51259944086e97658c6de405b6bd4beb355b4b7f8dc371cdc4982d19e140fd4495f9e2d63268839b329088cdef0c0015ce3c3ccce5ccd548e05c1aff4c9ef5987ae
-
Filesize
1.5MB
MD540bc23344a0f46f04cf0533ae12c86b4
SHA14330aa71cc6bce9eac084368d207f1aeeabbec50
SHA256e89d9804064dfff2a9890e595825a3074f88ffcbfe7c21800a9464d2aa9ab832
SHA512e2e32639b3080412ee5a4f898c7ed8f422e854bd8e759402d21eb2620333a60170f80e21998dbe3e2ec652a3c7dc1ff8528c52d5df7a95a35046811b752d4f45
-
Filesize
2KB
MD53f5ee8ff0dcf6f9b7b98936ffc437520
SHA14f854e42b4f39615f7aa8512eddc196f23a18629
SHA256e37b6e510e0bef6bfaed9611021ba6dae078bcffb53655288cc38e663ac7d749
SHA512288d87627a371e1343f7b1b05d7d3b4d3b91549e341e09e7f52092eeb9b33fe832b2d5eef42d55971149d0658fc554e206b995edf2841137badf47013ace3463