Analysis
-
max time kernel
149s -
max time network
158s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
27/02/2025, 00:51
General
-
Target
0bc5b37b122d9f5335f2b2b3d6532af7538a1ccb.apk
-
Size
2.9MB
-
MD5
eb4558531fd743d006db96d62b6eee5a
-
SHA1
0bc5b37b122d9f5335f2b2b3d6532af7538a1ccb
-
SHA256
24ee0cd3a0841533e1a17fb8093509492094142010c324a078ac57ee7b8c032e
-
SHA512
306fc3ad585cb2bb15fa0dc5534634f8c042e3c3fe421893fe7f13ca2be8ceb4a66e30a252ffec1020aefb137548a449f00ced2f2f8b7e5943cc849094d06466
-
SSDEEP
49152:HVj5tbVhOhzswxyKr8qfqe+5HwOhIV2XYN5OHgGsUtThM05I/D0NcxZBQr:1j5x46Ud+wOSVdN5kiUtThM0HyxrC
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Flubot family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.tencent.qqmusic1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD571d3c225fe4bccb1c1e8fe4384b3d8a8
SHA16fe305c0dbc42ea3e26a62fed3861235a9486748
SHA256510300af78b1c3d65dfc02ee7c00c97f371ed1915eb0b2babdb2cdc551059e38
SHA512a66d8b6c9d95870f15a29f3151ab381b48377414ed325bc87e1f496dc94730a348657eb6c2da08792e97fdd71df6e06b313190c96aa3d5118ed84d369e961bfe
-
Filesize
926KB
MD5ec76ba1db42cca790b01f0a74bbda88b
SHA111850c7121807f15af8c3994f0ce96092ebfa744
SHA256d1bcdf005ccb5925f631013db0c05b575cf32a8f88111f46daa617bc37c35f34
SHA512268726cfb88ebc641549acb09a2c46be5cec9e736c98d7d551bd4540ad6059e70cd7fff655258f46cf2a2c5f3124a334c0b003b555fa5bcc4fe00a45a43a3ae5