Analysis
-
max time kernel
98s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
23/03/2025, 21:30
General
-
Target
FedEx.apk
-
Size
6.1MB
-
MD5
1a2a4044cf18eed59e66c413db766145
-
SHA1
4e6e9995c3792d8cbcdd8aeb762bb0a6f74cef68
-
SHA256
30937927e8891f8c0fd2c7b6be5fbc5a05011c34a7375e91aad384b82b9e6a67
-
SHA512
cc069b2cc2e3c55190b0c840d98b2f6612e7779c759a24dfd903d96a028f5375ef806c40910efb98d566cef276557dab5cba13397cedc9a1ad56c1d2e1727ae8
-
SSDEEP
98304:piRrQE87MwGC0NnlKaNzvc0j9nj1lA9wVAe0bAQfkFLv0yim:pW87Mznl1XnRlA68qj0yn
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Flubot family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD54d1af208adc4e3b48ae49a8f9bb6a3bf
SHA1c01efaade18827744ea039b365b1392574cbe11e
SHA25635f92b7fab00a5dedec023de3bd5f4bc66f317043a62bee3d47c267bc28349b1
SHA5124ac2b3c9374abbed0a8169f51965711f19461695b905c0221b51883360803521e80f5087209ec134a2b0303f13add277eef3eb8dd2173861c334d7dfde958906
-
Filesize
3.1MB
MD59176c3e392a554fec7890533a61886ab
SHA174f83c8167c59c65ad1b508055dfac445bc08c25
SHA25627ed9910cd1e4f2357df3d687bb8a375b97c1a8655cf0c30a64eff495a9b3b1c
SHA512ffc4182c020c35d5a44eaf413943115d093ed4640bf9c9fa750c8fd8c6cca8947c1ddce3581b842bdb28588ce7af829dc4e23d1cb7f0b668f5c16c21adb3cbca
-
Filesize
2KB
MD5b724e0aa281dc0955e8c64075bb4fb78
SHA1766e9cced1cf1e95d3745a45907e118a67970b84
SHA25675092177f29f644561dc97e03201167547770beed46f6ac4b389f82715e08ed1
SHA5120008c1b25c63630a92e3c1fe5028eacf238fad096bfc1b078fe761569594e87ccdf3a523a5c1dc2fc575789e3dd4171ed6e480ff0640afcf9610baeca69ff140