Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
03-09-2024 22:03
General
-
Target
822f7878e84b144dc41bd5d2ed3a20df1078ea8a18b6fcc80283aac7137c8e47.apk
-
Size
3.8MB
-
MD5
0f02594634a633ff2e2efca9760a06d5
-
SHA1
0e18d7a6e1c7cfdc4e7aa78edf6f12337599c5b2
-
SHA256
822f7878e84b144dc41bd5d2ed3a20df1078ea8a18b6fcc80283aac7137c8e47
-
SHA512
f70ce28dd8509c0aec437bb87f6c147fe9661c58f5c4f55f85884f5466a884efe05d4420270627379462813b215a4c97e4eae2193bc811c96c178af44d576c7d
-
SSDEEP
98304:qPTZq21ENBavGDspPfTOcPWx/SdgNwD3kLMS6:qbZqgEN4vmspTxoO
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.tencent.mobileqq1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD59e185a0bab480be892ec9cadbf5bb591
SHA11e16c1543dcb7f0409ed39a12b775d94c3d5b97e
SHA2566f0b5d517541bbe7534db5102da07008b6039e0380f4cb84cf193e72fcdae311
SHA51287ee2836387306998ca63426323502c07b976b829307be7b7de2077fc6d1b7ee36de049f267e9ef19d88e92f299d622bf24b6881fae9181a6e32e853fb5bbb97
-
Filesize
879KB
MD55572f9d44b864b4e1d848b4de54a5700
SHA1bd766e46b7c22ab3421567bf83750260698a7684
SHA256afc5c4f43d697205834c3fd9b08154f30430f39df12c3286bd8d55751b8b0e41
SHA5128b40aba4aa870106aeb2e68ac06f455ca2e5070f62712c0958fc1b70cfe41227e6097c20c286612f2be73374ab56e98dad94573e36a1fe44403b4ef3c7cf50a7