Analysis
-
max time kernel
144s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
31-12-2024 22:00
General
-
Target
05f05f48b07c46ee14f665451d46010a958d420ea744b701159f68bc58dadd20.apk
-
Size
4.4MB
-
MD5
cf1094b291bfb104953ec20f9f99b69c
-
SHA1
bc39ecb0caa34146eb69f6a6663513f4a2fd5975
-
SHA256
05f05f48b07c46ee14f665451d46010a958d420ea744b701159f68bc58dadd20
-
SHA512
e44bd3fec728ac444dc51c1f489085af4082d4727a980594bc0677e07e249cd644945cc8ddb20816ec70270de24ffee71cc4d9e1d440adb52b778622f52a8b7c
-
SSDEEP
98304:WoWhlhDyAL01EpZ7CAwIZBcduq6A+QQYJMYKNYBNmCkP:hWhlYALWEpZ7b/Uu7A3MYKCBACkP
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Flubot family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.tencent.mobileqq1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
917KB
MD526599b06384caa7cdae1d2b05f56bc99
SHA122f901e04d82ff15657b8def6ffdd27e79a487f7
SHA2562d84344291bae275a222ac8b71f73d0d6d95624d0b5b0f7cd74789bf1d4e11f0
SHA512362da2ab412c7c04bfa3d2127cc1785dd2820fe15309478e5bb1b9d1954bd5241e94d3d776ca1bf87516f89585750f38707094f7b2f05089e23983ae9bb82e4c
-
Filesize
2.0MB
MD512a6bae1a1f34396bbf1e0adc6f182eb
SHA1eb722d41f1c16a2721945de3308f9ccc67b64ee6
SHA2567a601601559723794ea924a2220aabfdd23bb4379867fa0033a96ac78fd311e4
SHA512acd35f27ba47b8d9de8c3f1c674f83acae6f46b9717dd0c7550af12090d5504ff6f46a9a761148cea9872a2a5efadc350b312dc69abb0bdf14a02490aabefdee