Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
26/03/2025, 13:58
General
-
Target
df5944f9190614f04a8818a50438dfaf3339fa95289cdc0af54f8f239eb253fd.apk
-
Size
5.0MB
-
MD5
749510b3010a45fea2d2763476e17511
-
SHA1
79589fd0ba7c1d0afc8c3d1e22ed60a38585348e
-
SHA256
df5944f9190614f04a8818a50438dfaf3339fa95289cdc0af54f8f239eb253fd
-
SHA512
b98e95c300068d9273a0e8143f2c9fec31abd8d806cd653dc83ed580a07bda1de6d442a0540e4db5a0abd86dbfd67f012aa6fdcc0ac1b6e9803b0c65bc11c3e4
-
SSDEEP
98304:4mamSQUaXwpaqhRikhoWQafbXrXmZg5uQ+1xNGbFF8Djc13W3EAe:9SQUaXPSG9q5P+7NGbr8Ds3v
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Flubot family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.snda.wifilocating1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/oewkwyGGdh/lhkuwg5lw4eddfi/base.apk.hJywvwh1.exf --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/oewkwyGGdh/lhkuwg5lw4eddfi/oat/x86/base.apk.hJywvwh1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
925KB
MD578357617a7a1c726344d014a91519584
SHA1ed9a75a295404be96dc340305e24707776508b1e
SHA256260d359107da87dd8f46f0f9345b21d01c0350d417f49b5c02ad2ac5115e4976
SHA512f5e72b35ee9df0820ea3c7a4ecf17a4e1e87552130df2e58a7edd3405a4d76a66ffb9a66c6b8dd622daf9bb0ce1bf44c2ba9e5f04d4c945da6572cc52de04b89
-
Filesize
2.0MB
MD58f6a03d58739d551ce97c9ffe60a856e
SHA1273f2dacac5579c7f7c3af30a26ad90c1099ad6e
SHA256094a8f367da97786cf701d25c3531d2d9cd525fa201566ecded842d3504c9702
SHA512c1de4894812d9e1ca99bb49ecd3ec000b94803ca5858f846811dab7fb62e0a6867227635a16854f9861679ed440c1775db4242f590196acfa1bbae4c2fe492dc