Analysis
-
max time kernel
149s -
max time network
156s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
31-12-2024 22:00
General
-
Target
05f05f48b07c46ee14f665451d46010a958d420ea744b701159f68bc58dadd20.apk
-
Size
4.4MB
-
MD5
cf1094b291bfb104953ec20f9f99b69c
-
SHA1
bc39ecb0caa34146eb69f6a6663513f4a2fd5975
-
SHA256
05f05f48b07c46ee14f665451d46010a958d420ea744b701159f68bc58dadd20
-
SHA512
e44bd3fec728ac444dc51c1f489085af4082d4727a980594bc0677e07e249cd644945cc8ddb20816ec70270de24ffee71cc4d9e1d440adb52b778622f52a8b7c
-
SSDEEP
98304:WoWhlhDyAL01EpZ7CAwIZBcduq6A+QQYJMYKNYBNmCkP:hWhlYALWEpZ7b/Uu7A3MYKCBACkP
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Flubot family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.tencent.mobileqq1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD512a6bae1a1f34396bbf1e0adc6f182eb
SHA1eb722d41f1c16a2721945de3308f9ccc67b64ee6
SHA2567a601601559723794ea924a2220aabfdd23bb4379867fa0033a96ac78fd311e4
SHA512acd35f27ba47b8d9de8c3f1c674f83acae6f46b9717dd0c7550af12090d5504ff6f46a9a761148cea9872a2a5efadc350b312dc69abb0bdf14a02490aabefdee
-
Filesize
917KB
MD526599b06384caa7cdae1d2b05f56bc99
SHA122f901e04d82ff15657b8def6ffdd27e79a487f7
SHA2562d84344291bae275a222ac8b71f73d0d6d95624d0b5b0f7cd74789bf1d4e11f0
SHA512362da2ab412c7c04bfa3d2127cc1785dd2820fe15309478e5bb1b9d1954bd5241e94d3d776ca1bf87516f89585750f38707094f7b2f05089e23983ae9bb82e4c