General
- Target 664c1b4ef5e7caa17e3caa5a4bc0dcfe6fba23beb866ca8959a3791512d33798.bin
- Size 3.8MB
- Sample240804-129sbssblc
- SHA256 664c1b4ef5e7caa17e3caa5a4bc0dcfe6fba23beb866ca8959a3791512d33798
Score
10/10
Malware Config
Targets
-
- Target 664c1b4ef5e7caa17e3caa5a4bc0dcfe6fba23beb866ca8959a3791512d33798.bin
- Size 3.8MB
- SHA256 664c1b4ef5e7caa17e3caa5a4bc0dcfe6fba23beb866ca8959a3791512d33798
Score10/10-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Removes its main activity from the application launcher
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Requests accessing notifications (often used to intercept notifications before users become aware).
-
Requests changing the default SMS application.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Requests enabling of the accessibility settings.
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1