Analysis
-
max time kernel
130s -
max time network
133s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
02-09-2024 22:02
General
-
Target
3865302b66b0efee4ab31130cefdeff55c2e269c7d6dd03c0673134f98254185.apk
-
Size
3.4MB
-
MD5
83c3142eeb1fc5a3d88807c0c738c543
-
SHA1
f0e99360e5c78ed7b8b3d08abc58aaebc9daf4c8
-
SHA256
3865302b66b0efee4ab31130cefdeff55c2e269c7d6dd03c0673134f98254185
-
SHA512
94741012e99c9685cdf7354117074f40e1f3ac4f60f934279745ceb5146eccf31701a44b23d728ad3d9c52a95af6a00dbd5bc1366bc7fb9fa2a0127b27926bdd
-
SSDEEP
98304:dKi5SaYvkjZRFJjAC7mc7KAndX42bIeIJ7l:tS6j7FJdx7lnh4kIDx
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
Processes
-
com.iqiyi.i18n1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about active data network
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5681a8c94879a5fba26735daa55551a7a
SHA1ce3e25947da0b9fb718d915a332d9c9e2fa4faae
SHA256c24523c719067daad805b1d68cfef8d2c377a5c5f52092b96093b4488e6e82a2
SHA51219ccd60e41489072df2f84e67840875d3ad5c83914b4d3c5e1ce209a10dc17cfc086fd66d35aa907e7110a7ab51e7d2f84be34ca1f96461316a04e09a789f7f7