flubot | e51c822a837ed265b22afa7ab43866c25dce63a689ade4b9fc74afb014386cac

Resubmissions

15-07-2021 10:39

210715-8tkstjqp6j 10

15-07-2021 10:37

210715-7aw1ptf4m6 8

Analysis

max time kernel
2848077s
max time network
50s
platform
android_x64
resource
android-x64
submitted
15-07-2021 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e51c822a837ed265b22afa7ab43866c25dce63a689ade4b9fc74afb014386cac.apk
Size

4.2MB
MD5

24037a7c201cbe70d6daadc909faf4cf
SHA1

4adb09602f76dfbbe814912ffb5e4b54a71591e0
SHA256

e51c822a837ed265b22afa7ab43866c25dce63a689ade4b9fc74afb014386cac
SHA512

df173bdfc03094b3f58180680d7240705ef0a4e3f4c56f9c4f9cbe58291daba1945aa7889372d8920d5ce0e842f7af863fd7ce58ae233fa7389bef5626810d48

Score

10^/10

flubot banker infostealer obfuscation ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/16TmTlQB.ood	family_flubot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.mobileqq

ioc	pid	process
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/16TmTlQB.ood	3593	com.tencent.mobileqq
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/16TmTlQB.ood	3593	com.tencent.mobileqq

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.mobileqq

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.mobileqq
Uses reflection 1 IoCs
obfuscation

Processes:

com.tencent.mobileqq

description pid process

Invokes method android.view.ViewGroup.makeOptionalFitsSystemWindows 3593 com.tencent.mobileqq

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mobileqq

description	pid	process
Invokes method android.view.ViewGroup.makeOptionalFitsSystemWindows	3593	com.tencent.mobileqq

com.tencent.mobileqq
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
- Uses reflection
PID:3593

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/16TmTlQB.ood
MD5
40e5e00d9dda773d1e0ad001781585b0

SHA1
ac0b71ae894a41f02836aa7499e5abb5259be4f7

SHA256
dcce0aecfbc8bab24f05d828e1bead4cf385ca4becedc333c58bcab61988c4fd

SHA512
33270e6e127a1476b6c7961a2eab4e15f05d77f703a5224c6b576aa0eb32fe9eb463782b5b3e47f06fd34bbd576b31ec5d2de88ec89dd341af508c002ff72cdc

Download Submit
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/16TmTlQB.ood
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/16TmTlQB.ood
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.mobileqq/shared_prefs/Voicemail.xml
MD5
bdee3df90b7b3d6d76b2cf7df3ff37cd

SHA1
b37154d9e4f4046d5d731aa751908118247b543c

SHA256
c410f3403409d1ff9db876d92178b2bd09ec758b69e729905b335d79ae48fc6b

SHA512
40557523a6299b0f4ada6348348473008ae24a9725d51a0c4fe56c0218928ba92b5e6b91a7da0159fbafdca43df31a3902e2af277e2a4d113eac02765f54957f

Download Submit