Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
09/04/2025, 22:13
General
-
Target
8e4307f958ef3e5c62e3f0c75176044be90c4863fa546a19a716635379367b97.apk
-
Size
4.8MB
-
MD5
afa0e0d9a5a4c04cc27529611cc14e10
-
SHA1
2c7eda5dd664bca45e46366fd73f868f59aa498a
-
SHA256
8e4307f958ef3e5c62e3f0c75176044be90c4863fa546a19a716635379367b97
-
SHA512
6f8ec0148e7d4d016f23569d1777890b2fd5d24c8ee0bc4193311005e41faec97484c9b7ddb1981fb0fcd798c45a33254d2283297e8365a32bde90288dddb16f
-
SSDEEP
98304:nntSFACZS4YkeOocf0GyqUzhLvS2EuCgvTMPAgi8BFp/BZd4AnObpD1YsFn6:ntS/ZtYkNocf0GDGu2EuJvIPm8BFFdLf
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Flubot family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.tencent.mobileqq1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
926KB
MD53518269466786fb051a325bbbda1c503
SHA1fd6de26618e4c43f79417f51b71d0f5ffe4c7ed7
SHA256123891b598d35bbaedefa21bdd356a012d4f19200d222b0042a6da4119eeb36d
SHA512a87552d7ba140aaa83a92eaf736c44e10bd4fd1c62d35e2734e4b2e5d112977dfc03d6a697913afff347c788206303a3b0057d19d108ae2d7da6c85f4e83fb94
-
Filesize
2.0MB
MD563d9afc3e175f404b88d33ca77d13bff
SHA1666f529dfc341e945bb9a4c72e3489bb2979a4d1
SHA25634162d3f6b5c4d97769abb4e753b1ff4581b4e60537c186836ffc1fe8116f0b0
SHA51296ea57f78069528d731e5e2ae7d179c67c9be4f33fe590687451f72b34e831706b6325a472ed995ac54447d79b72518c71a155363d0001015f5faf32347b6c0b