Analysis
- custom tags
- max time kernel
82s - max time network
152s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
- submitted
17/08/2026, 01:23
General
- Target 6323ac65167e8d48c3bd6c8b839eb600b5b9be9b942e582640147be8d98cedb6.apk
- Size 2.6MB
- Sample260817-brscvsdj2s
- SHA256 6323ac65167e8d48c3bd6c8b839eb600b5b9be9b942e582640147be8d98cedb6
Malware Config
Signatures
- Family: FluBot
FluBot is an android banking trojan that uses overlays.
- FluBot payload 1 IoCs
- Custom signatureAndroid SMS interception and OTP exfiltration 1 IoCs
Registers a high-priority SMS_RECEIVED receiver, parses inbound message bodies and aborts the broadcast to hide messages from the user, alongside network exfiltration primitives. This is the standard 2FA/OTP theft pattern used to complete fraudulent transactions.
- Custom signatureAndroid banker: accessibility service abuse with overlay injection 1 IoCs
DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.
- Custom signatureContact harvesting with SMS self-propagation 1 IoCs
Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.
- Custom signatureNotification listener abuse for OTP and message theft 1 IoCs
Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
- Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
- Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
- Queries information about active data network 1 TTPs 1 IoCs
- Requests changing the default SMS application. 2 TTPs 1 IoCs
- Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
- Requests enabling of the accessibility settings. 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.baidu.searchbox1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
8CYbZjFp.blue