Analysis
- custom tags
- max time kernel
76s - max time network
151s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
- submitted
16/08/2026, 23:51
General
- Target 4d3ea6e701b950516b89a4be889a31635e9f892705f34345017d323bfcd6e110.apk
- Size 4.0MB
- Sample260816-3wefcazvg1
- SHA256 4d3ea6e701b950516b89a4be889a31635e9f892705f34345017d323bfcd6e110
Malware Config
Signatures
- Family: FluBot
FluBot is an android banking trojan that uses overlays.
- FluBot payload 1 IoCs
- Android SMS interception and OTP exfiltration 1 IoCs
Registers a high-priority SMS_RECEIVED receiver, parses inbound message bodies and aborts the broadcast to hide messages from the user, alongside network exfiltration primitives. This is the standard 2FA/OTP theft pattern used to complete fraudulent transactions.
- Android banker: accessibility service abuse with overlay injection 1 IoCs
DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.
- Contact harvesting with SMS self-propagation 1 IoCs
Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.
- Notification listener abuse for OTP and message theft 1 IoCs
Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban
- Removes its main activity from the application launcher 1 TTPs 1 IoCs
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
- Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
- Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
- Queries information about active data network 1 TTPs 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.tencent.mobileqq1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
1ZSxwFVb.k7s