Analysis
-
max time kernel
64s -
max time network
150s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
27/03/2025, 08:58
General
-
Target
89025ff12018ed90a709f3c8bf47b803c5c5b2b533858bda398fca3e1d6140f1.apk
-
Size
4.4MB
-
MD5
6a0660a71795cb8d67370524b56bb29a
-
SHA1
681a02883944f6f14963815e854f3fa3de5cc6f3
-
SHA256
89025ff12018ed90a709f3c8bf47b803c5c5b2b533858bda398fca3e1d6140f1
-
SHA512
318cd57c16e0529a9ff1021533298f5a79418da15c81f71f8138da9ff344e0a8135974b77a48456507d0215e4af8eab651b44ea00a2edb3e0d55fc8c7620b3b0
-
SSDEEP
98304:41DNrQxdkTDyZWINaesGQn59u9lfACK6tlt6C+E/ECH:4J1Qxdcy/NafGQ78fA76tltNJ/ECH
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 2 IoCs
-
Flubot family
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.baidu.searchbox1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.baidu.searchbox/app_apkprotector_dex/Hd6c3m8B.wet --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.baidu.searchbox/app_apkprotector_dex/oat/x86/Hd6c3m8B.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.7MB
MD555edd79ed0f52c94d30081507f3fb07e
SHA1bef26565917d6d5d491018a0fd61113f4d09437c
SHA2568e6f1568212fb6d486c82c8e0c3fdbe743e0526408ca8f862783dcc4cefa7060
SHA51282c6e6f1d90f9a465919294a01bd953c95f5aecbb636c0e2cd652570bb241bf67d69471418285c32d6a827c0ece158fe4399c09470d036e3fc456db851b830fc
-
Filesize
4.7MB
MD50ddbe111e78fa8ee1a70a8ea4f0c7eca
SHA13efcff1507f9b7d20750c3034e66014d26f6ab19
SHA256663b303188c9ff95736b535dcb3ae78d8033d342550cec789b61d401a8f879bb
SHA512402587240076b5c91bedc67dc5dfa14251617afdc8ae4813012a8e66f0d4bbd22d9258828ad0c72451863ba0c688822b8805dd92470c9ed8a775322b5a24107c