Analysis
- custom tags
- max time kernel
145s - max time network
151s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
- submitted
19/08/2026, 01:10
General
- Target fc45b5f85cee56830a9f7e3001dca42026a9691445afa8f429b57203fc47a1b2.apk
- Size 3.3MB
- Sample260819-bjhtfscd39
- SHA256 fc45b5f85cee56830a9f7e3001dca42026a9691445afa8f429b57203fc47a1b2
Malware Config
Signatures
- Family: FluBot
FluBot is an android banking trojan that uses overlays.
- FluBot payload 1 IoCs
- Android SMS interception and OTP exfiltration 1 IoCs
Registers a high-priority SMS_RECEIVED receiver, parses inbound message bodies and aborts the broadcast to hide messages from the user, alongside network exfiltration primitives. This is the standard 2FA/OTP theft pattern used to complete fraudulent transactions.
- Android banker: accessibility service abuse with overlay injection 1 IoCs
DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.
- Contact harvesting with SMS self-propagation 1 IoCs
Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.
- Notification listener abuse for OTP and message theft 1 IoCs
Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
- Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
- Queries information about active data network 1 TTPs 1 IoCs
Processes
-
com.tencent.qqmusic1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about active data network
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
tmp-base.apk.classes2711989263926922286.zip
base.apk.classes1.zip