Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
26/03/2025, 15:07
General
-
Target
2c74efb0e8304948e56f4ccb1ced6c05734842ecdc95628decacfa74d06baf6c.apk
-
Size
5.0MB
-
MD5
729160d423c809ec7d4802fef9010076
-
SHA1
05e887acc64b92764a7ce9156745e59b42f1144a
-
SHA256
2c74efb0e8304948e56f4ccb1ced6c05734842ecdc95628decacfa74d06baf6c
-
SHA512
629e172df2ee3d0a2389f2dfe6cef08b034fcaf07d0136949d06b13b45514d7c98f67da0f22f7491ab9ef9eede945f4267a3604a70effa0aaee9a3b9cc18f8bf
-
SSDEEP
98304:p6nnEiSsLombCuNZGFOxXknnhoZI9wHRp73rXTdgksiIAiLFY0YsET8LA3W3gr:pCtoeGFOx0nnhp9wXC2I/7YsS803V
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Flubot family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.snda.wifilocating1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/s4Jceogvrh/fu5xmhyw4zvekxw/base.apk.4kifbfJ1.bhb --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/s4Jceogvrh/fu5xmhyw4zvekxw/oat/x86/base.apk.4kifbfJ1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
925KB
MD5168cd6138a9f3681cf09eec3c41fd173
SHA1afee24fb8dd5495949bc519472f9e6de59c1eb02
SHA2560cc5e88b048911584df4c6e33066214d9a1627efe60b21c1cc6538bd6e40059a
SHA5128cbe8cec7ff3d7b4293e6388467e22bf9e5029a3264dfa4da7532b3268cbcfe91bb81e7f1cbb9d96905430726e32633fdfcca2540984912d474bd6057e01a4cf
-
Filesize
2.0MB
MD5ee15561fb74229b06306fb6227768c53
SHA181077fffc6c2b313bc53939de4f4dc760f75a42e
SHA256fb91885f78ebd389ae76ad4c19e10626c2f076648a42248ffebc97554ff55bf7
SHA5126b2f7d7d75714b25ba01018e85d2200bacfca1ee5c0024c8cdd879b1f99b58de90a2562aab193047cd760ac1c66b476ca3233da13383f2c0f072a0cc1f27be4d