Analysis
-
max time kernel
116s -
max time network
158s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
27/03/2025, 07:32
General
-
Target
6323ac65167e8d48c3bd6c8b839eb600b5b9be9b942e582640147be8d98cedb6.apk
-
Size
2.6MB
-
MD5
b65b16fb181011fdaf1fa4bcc22edf5b
-
SHA1
93c3c66ede2d13c5ec2325ee0f774a6808c0d7af
-
SHA256
6323ac65167e8d48c3bd6c8b839eb600b5b9be9b942e582640147be8d98cedb6
-
SHA512
6ea8a8c5ca4875707ac338236f9f945787a793ee125a41f8a4423d3e5b6339ddd8bf59432f17da5c1c98026001f797d0520b51bc0d16bafe68d931b202a10d76
-
SSDEEP
49152:w2mWPAlycYeV11r5N1SlVF4VyNHBn9bsTaU6KbN39kpkOwdWp8fAV6uXhDL9Iqq:Mdlkeb1r5aPFIkHxFs+49PcfVXhvu
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 2 IoCs
-
Flubot family
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.baidu.searchbox1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.baidu.searchbox/app_apkprotector_dex/8CYbZjFp.blue --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.baidu.searchbox/app_apkprotector_dex/oat/x86/8CYbZjFp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD516e74e8e6081d78fc2f804d30072bac1
SHA146a2b5cc24ed7bf38150336254cb97900cebfdf1
SHA2564c84e63a079fc96c2905123315fe2471f80a460747631e47bb8f9bfd36c20fb0
SHA51208e1eec4271a23d3800516984c439a93299826c7786db9cc8808a46e8c2017af0d52bebac5558c1861cd4483ee3233adda361647b62e49863f106ccc31de226c
-
Filesize
2.3MB
MD58d56defc502f14117efdecb2ed46ff94
SHA1d37fd01d8e4d2ca0f0e94330a26931ab81fdb6e0
SHA2563495302848d1a0296d345d83d5eac6315a0beaaf0ff20a0d73c8df3484f31870
SHA512f8eff072df79c6263162f06f5737eecc64abb7d24f7af9121e61f6fb56fce4cd82e8d730defd01dec527ea46fa4d687592dfabb88fbc44d791bb52525e48a338