flubot | c0a562759f136fc761fc23b299aadba8b4a96d4802adff067cd2e6c3461d68c1

Analysis

max time kernel
193950s
max time network
19s
platform
android_x64
resource
android-x64
submitted
11-06-2021 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.apk
Size

3.8MB
MD5

af10d88e77b84853582d76352f5155dd
SHA1

484239200a2927b23c1b9706607b34a7fa26ee34
SHA256

c0a562759f136fc761fc23b299aadba8b4a96d4802adff067cd2e6c3461d68c1
SHA512

be1b10d848574c7e1c63585394e2e5f0f2b50e6481b205c68f6b34356e40001fc07767f09161cad6121d4f95adcfe95b5647d1a1e273eb995b9055d7130daf0f

Score

10^/10

flubot banker infostealer obfuscation ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.qqlivei18n.us/app_apkprotector_dex/72VfhkVb.json	family_flubot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.qqlivei18n.us

ioc	pid	process
/data/user/0/com.tencent.qqlivei18n.us/app_apkprotector_dex/72VfhkVb.json	3592	com.tencent.qqlivei18n.us
/data/user/0/com.tencent.qqlivei18n.us/app_apkprotector_dex/72VfhkVb.json	3592	com.tencent.qqlivei18n.us

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.qqlivei18n.us

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.qqlivei18n.us
Uses reflection 1 IoCs
obfuscation

Processes:

com.tencent.qqlivei18n.us

description pid process

Invokes method android.view.ViewGroup.makeOptionalFitsSystemWindows 3592 com.tencent.qqlivei18n.us

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.qqlivei18n.us

description	pid	process
Invokes method android.view.ViewGroup.makeOptionalFitsSystemWindows	3592	com.tencent.qqlivei18n.us

com.tencent.qqlivei18n.us
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
- Uses reflection
PID:3592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.qqlivei18n.us/app_apkprotector_dex/72VfhkVb.json
MD5
67767b1fb562fa4bb4607334b3310aaf

SHA1
dc854959d326ae4f697cc96a9c55bee9c07ee7d6

SHA256
f58157e1e9d9a28ca600a45921f3a4b9401defa65d333536101784b0577ac4b4

SHA512
4c921b11a89aabbe16bbdcffc93efb151fe81a2e170385a987aa052e90d2fafae2b8f889de6a0acdd79135792432de76bd0d2e266c6820d269e988656f3eb483

Download Submit
/data/user/0/com.tencent.qqlivei18n.us/app_apkprotector_dex/72VfhkVb.json
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqlivei18n.us/app_apkprotector_dex/72VfhkVb.json
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqlivei18n.us/shared_prefs/Voicemail.xml
MD5
9827167280ca748bc46a35248ef6759b

SHA1
a40c9a445f29267aa18cf62713f4f3dec12da4b7

SHA256
8a1f8e61f9177fe3909bf06c56338dec73a1d0d91317a4d5ef2631a7f4a77071

SHA512
c211f2a5a11eb62ba8a45d234beda170385133f0d44d864f37a97cb80a9803c32a9be00304c9225d31fcdb83ed2728bc934fa6903fb4795522b0401ad82aa953

Download Submit