Extracted

• • Target

    Fluxus Official.apk

  • Size

    13.8MB

  • MD5

    3ed6024213496613d1881c71abb03d00

  • SHA1

    83bd095b53b81b11ab44a9b4b73ffb7d2750b989

  • SHA256

    56a3bc1c037fc18536914143d057dae1064499529ec59532eca83a50a0e97894

  • SHA512

    404f0f56aed2f7053562d75ad49a71470905a7339045cec719b5bcb16811cef157ca55cbb5172ac194997bedcd1e604fc24555451dc08f90de0dd50a2f3c907f

  • SSDEEP

    196608:+UNVtS4ieuPtnRqtAQehgvI0JH4cyoYOiKaN1OzCGOzp7NW0:+UNVtShgQE4pBuaNhdRW0

  Score

  10^/10

  remcoshostadwaredefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationratstealertrojanupx

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Legitimate hosting services abused for malware hosting/C2

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Probable phishing domain

  • Suspicious use of SetThreadContext

  behavioral1