flubot | 06dbf0e0bfab9f74c0744b8fe29bec1cf48171bce9df7ff56be34a62babf15d2

Analysis

max time kernel
854289s
max time network
53s
platform
android_x64
resource
android-x64
submitted
22-06-2021 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Voicemail.apk
Size

3.8MB
MD5

0a296c35e1d7ac2c69cd62b3de246a19
SHA1

9f941ba530d50b907257f9558697cd6ba1617f80
SHA256

06dbf0e0bfab9f74c0744b8fe29bec1cf48171bce9df7ff56be34a62babf15d2
SHA512

44e35b961022871e634d006e575a04c1a3b0cc7d0f07ba23dbdca64435a5aec635002fc701da5f02e6755eb773c5d01699ab8a304580700c74c3a2051e5fccca

Score

10^/10

flubot banker infostealer obfuscation ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk	family_flubot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.eg.android.AlipayGphone

ioc	pid	process
/data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk	3593	com.eg.android.AlipayGphone
/data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk	3593	com.eg.android.AlipayGphone

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.eg.android.AlipayGphone

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.eg.android.AlipayGphone
Uses reflection 1 IoCs
obfuscation

Processes:

com.eg.android.AlipayGphone

description pid process

Invokes method android.view.ViewGroup.makeOptionalFitsSystemWindows 3593 com.eg.android.AlipayGphone

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.eg.android.AlipayGphone

description	pid	process
Invokes method android.view.ViewGroup.makeOptionalFitsSystemWindows	3593	com.eg.android.AlipayGphone

com.eg.android.AlipayGphone
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
- Uses reflection
PID:3593

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk
MD5
fc4caef2883f0c750e6560102ee2ff70

SHA1
52de160de2f277dc9b7fa0220dc23e16ca22d1bb

SHA256
3dbe43af14530a6db63ed4ee7064663086d35768e6a0b0cbfd5493b0ec9b06ea

SHA512
6f540cb3a8ff85480c97218416aaaa9627c03fa7781347e507f1579a18e4215da404114c9bcc082121f99f497ad55c16ba52b734c15edb2111b3c9bfee7a06da

Download Submit
/data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.eg.android.AlipayGphone/app_apkprotector_dex/ySq3pvnl.elk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.eg.android.AlipayGphone/shared_prefs/Voicemail.xml
MD5
8cc91ba49e5df502d7547c9717bbcf0c

SHA1
25c4eb66517b3defa1f7395d93db3f6807e14826

SHA256
08938d7be49c85a52aebaa8383987f007c0240fae633874733b1b6a9d94c8d97

SHA512
fe796a0817648de92d5e437bc92db5b15f32257d1b84fdf3699777ac0a47592904b2a810513b7bb12e2f825263a4afb61e42ad5967c93694a034ac6ecb7cd794

Download Submit