Analysis
-
max time kernel
147s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
20/04/2025, 22:03
General
-
Target
c252746bcface60fe83fdb2f31268567780c45d5886e1af8b02ccb1d65a83133.apk
-
Size
4.6MB
-
MD5
2ef09cf7dd58f0dcc2b537abab1904f6
-
SHA1
602996d906e25b9540e56e5adc7a5d9c6daec5ea
-
SHA256
c252746bcface60fe83fdb2f31268567780c45d5886e1af8b02ccb1d65a83133
-
SHA512
47a8e5cd02e8d9e2d45a38712e496454ebbf69bdca892ac59aa5e4446ca90cedc86f29020ed1247b897fb942f14cfc08350c2a1db90b570d8456b373c5a54c1b
-
SSDEEP
98304:rNPYedT1FpVjDacKJ4qU58PcuIAJjoDrRz7uWAbDRb+BFZxyfRrsrRL:rNPYaFrOFCv8dbEdz7uWA3RbwPYfRwZ
Malware Config
Signatures
-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot payload 1 IoCs
-
Flubot family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.snda.wifilocating1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD596dd717225f3de5eb2bbf1c6769f96b8
SHA1b3dcc85622cb7d88d6df52772ff8dc1c3dab1735
SHA25697614be0ac9394e04d9b457ceda798f732c2431ee930a5b9cc179f00d1a079f8
SHA51284543e5372dd21d6ebae864f2bf78e0cb43a341b69dd7cb5cc3fb3f0ae0a0b9fa34b87eb94b327906cab60a908a1c8ac561bbaa09b627777bcb0cfefec15b32e
-
Filesize
926KB
MD535fc2a98b224b7e8bfd32c8a66cebafe
SHA10daf43d519d93fe744e514edf848b5f5cdf81512
SHA256a56f5c0a1c257effe7eecf494c5797c3797a5259b2202854b9fa5a335ce36453
SHA5124c76cea3050820a3eedc8c2c50bdf0c88236904452999df4b5902e347d2bb9a24698912bf5844a2b3f132e47fd29f529402604ca471918fd294898b38c771926