Analysis
-
max time kernel
149s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
02-09-2024 07:44
General
-
Target
cc088e5ca8277a42cd0cfa14988d8af0f69194c5808a0d8cb33aada333e92f6c.apk
-
Size
5.4MB
-
MD5
c06aa910841cf4c7f020b9a6f30663d3
-
SHA1
39f8fc6e4ad8f3fbf6d26542dae6ef704be42a0c
-
SHA256
cc088e5ca8277a42cd0cfa14988d8af0f69194c5808a0d8cb33aada333e92f6c
-
SHA512
899067119bd7918b5e98779ac6367f17fdc53c1d62aecad164c504b338c974adaf46d7055fc68c69d881144ea263972dd77392d4059b123b697e16c5b0dc76c2
-
SSDEEP
98304:bg6Bvfymd5SsncjHaX642ziJO+k0Z51iMvmHj1gDOQntmsS8yU2Kac6ur2ftPQ/S:E6Yms+K42sdDZ51NSgi6tvkcsft2S
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.tencent.mobileqq1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
939KB
MD5c89fe90317ff9904fe5319375122176d
SHA1afd32622b194247bac1f95e87e0a4568d329b0f4
SHA2568bda2b9d3f7ad15a64aa8116c7dd8df32137280b6d8b297ad40328db071bef49
SHA512b511b479754019a73fdd7e8560ef21f2fdb96735889e473937a0a68314fc29f329edfc76458c27229eb91079f882002cb07391948b9216f45c1c2b76f357f6f7
-
Filesize
2.1MB
MD5edd35d9d7f478c0d26a64eaa13613942
SHA127b4c8b7ea51aacea262385dd628806f16eb4a8d
SHA256a8f26e5f12d32575322c7cd5c7ae8a17431abf140eb3a4b2c033912f9d65b728
SHA512edb00e5572d7ba3c43741ce0f1fb5ad3b261fe798962603a61f4e1493bdc0ac850b146450e2db3bc4e902015d8e133575a9d79813d4a452cdff69839e5502372