flubot | c3c3394e459bb244e9e5a6923739086b0cd37b51c732bce7fed63db9a9ee2d2b

Analysis

max time kernel
2152727s
max time network
19s
platform
android_x64
resource
android-x64
submitted
06-07-2021 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3c3394e459bb244e9e5a6923739086b0cd37b51c732bce7fed63db9a9ee2d2b.apk
Size

3.9MB
MD5

2e34b6fdf50aad8adad407bb49d79a2d
SHA1

ca73e698212f5e829305d3d1e882592e21aaa6a8
SHA256

c3c3394e459bb244e9e5a6923739086b0cd37b51c732bce7fed63db9a9ee2d2b
SHA512

275d66589750742c0d2cff4e536dc422d4733f329e108d90f87fc596c9dde9d79ad4ab741e2893a00e14b00b5faa8151284304b91f3ea189040c16329eb96a9f

Score

10^/10

flubot banker infostealer obfuscation ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.baidu.BaiduMap/app_apkprotector_dex/bPjniyxD.tf	family_flubot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.baidu.BaiduMap

ioc	pid	process
/data/user/0/com.baidu.BaiduMap/app_apkprotector_dex/bPjniyxD.tf	3703	com.baidu.BaiduMap
/data/user/0/com.baidu.BaiduMap/app_apkprotector_dex/bPjniyxD.tf	3703	com.baidu.BaiduMap

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.baidu.BaiduMap

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.baidu.BaiduMap
Uses reflection 1 IoCs
obfuscation

Processes:

com.baidu.BaiduMap

description pid process

Invokes method android.view.ViewGroup.makeOptionalFitsSystemWindows 3703 com.baidu.BaiduMap

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.baidu.BaiduMap

description	pid	process
Invokes method android.view.ViewGroup.makeOptionalFitsSystemWindows	3703	com.baidu.BaiduMap

com.baidu.BaiduMap
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
- Uses reflection
PID:3703

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.baidu.BaiduMap/app_apkprotector_dex/bPjniyxD.tf

MD5
1d69bf349cbdae04b9aefd27b9f54f6e

SHA1
7de0ed5fee14464309aa99369250757d4ccaf768

SHA256
885e140367c1cda47fae5d596c4311609ed6db29c22639b368550b42aa105cdb

SHA512
2cdfa033242e542cf91241603b787effc48a27e754f03e434e88ee37b508d9f0c446bf49d0719a1d1971845009e6186ca035135d8f27cae4dabf70989ba44063

Download Submit
/data/user/0/com.baidu.BaiduMap/app_apkprotector_dex/bPjniyxD.tf

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.baidu.BaiduMap/app_apkprotector_dex/bPjniyxD.tf

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.baidu.BaiduMap/shared_prefs/DHL.xml

MD5
ab8b8276c6fb139174ad95c6f034f9f2

SHA1
b140080d6a75d2096d356c7fa30bec278fc9afbe

SHA256
55393d3a1113145cf6e38c6a36c9f7ee3178ce508bb3f7201ce9164bd636f157

SHA512
84183f29f70980861c3e34b3ec103870da5fafebc889567d0b92436e063795bc3986caf29caeb0c145cd4f50c58ff413e9ffcaa73449d426e28c142a01ab7b02

Download Submit