flubot | dcfe4d8c0265186f24f56cb774f0087cfde3d46fc0d31a7edf7e036a2006513d

Resubmissions

05-08-2021 10:44

210805-ebgy4zjg7e 10

05-08-2021 09:33

210805-xpc438g9ts 8

Analysis

max time kernel
367824s
platform
android_x86
resource
android-x86-arm
submitted
05-08-2021 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcfe4d8c0265186f24f56cb774f0087cfde3d46fc0d31a7edf7e036a2006513d.apk
Size

3.3MB
MD5

305c6ef783ba3db66c8b3262d0ad26d6
SHA1

efd066effa3bfea6c04521a1b32c417f9d19ed34
SHA256

dcfe4d8c0265186f24f56cb774f0087cfde3d46fc0d31a7edf7e036a2006513d
SHA512

b625d6838cd10bb75cf4e25e97e98c3bbbbdf51c020a085ba140dd036994c1f6661efab53b4dbfd42e77f52eee11200537e8f87b851509640ac09886792e5a03

Score

10^/10

flubot banker infostealer obfuscation trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/oat/x86/base.apk.classes1.vdex	family_flubot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oatcom.tencent.qqmusic

ioc	pid	process
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip	4806	/system/bin/dex2oat
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip	4754	com.tencent.qqmusic

Uses reflection 1 IoCs
obfuscation

Processes:

com.tencent.qqmusic

description pid process

Invokes method android.view.ViewGroup.makeOptionalFitsSystemWindows 4754 com.tencent.qqmusic

description	pid	process
Invokes method android.view.ViewGroup.makeOptionalFitsSystemWindows	4754	com.tencent.qqmusic

com.tencent.qqmusic
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:4754

com.tencent.qqmusic
2⤵
PID:4806

/system/bin/dex2oat
2⤵
- Loads dropped Dex/Jar
PID:4806

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/MultiDex.lock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex
MD5
5ad2e535b9755130a320adf04ef92994

SHA1
b9a01642a0600b26db445f96a5b49697c23d5653

SHA256
95168fd5aad1e28697ea50218d4307c6bd6636a8615efc12d1ff3e643268e948

SHA512
b6ddfcdd7a2a962ec5a5c1a904120b9464fea5864d25cc578ceeefc25bb8eb6200b4943436f1b20ad835dc6649dfb4ea4b1d9449ae9188e1a5f324efacda1c13

Download Submit
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/oat/x86/base.apk.classes1.vdex
MD5
2bf46801f393e1b1bb66496c18d5e615

SHA1
2f1b23fb9249aa3cfa8d173395e639b51633a6ba

SHA256
e3bf994130070fcb141ec2f02b76f507db35df865e017c587a4646a26960a1b4

SHA512
04180237bb7d9cc77de85faf0888ccf8b405bc8442de4a067f4758012a9fc87f912b26a070ab79cb254e7f11a242048dc72bc9d41d2432a279d29e9d33607df1

Download Submit
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/tmp-base.apk.classes8097687492083287111.zip
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqmusic/shared_prefs/Voicemail.xml
MD5
b72edcbac0ec6b98082b7d793d56e6ab

SHA1
7713a7c78984579d5aadb5fad84a8e4d6e90f163

SHA256
7a85f7a477ca07ab69c912a12ddd26c15aa615b1de54adeefe34089943adb6a4

SHA512
676e8c51413d1c05b7159ece2946ab072b2047cfb6162ef0eedf76f5109111b1c7c8fa60015aba257623dabcbb851d859250590c6509556aa3fc4f6755546c01

Download Submit
/data/user/0/com.tencent.qqmusic/shared_prefs/multidex.version.xml
MD5
0f3eba50577ef5f3e426ef1fdb1e3487

SHA1
728d0fcf84a02558425d4228b18f3b35442d7c6b

SHA256
24013b8acb0681e612ba2cee0930734a40ff79635dded677e56e585372a26250

SHA512
17f9cd0cb1ad1d307c3c1fc6de689f389e8379ffd14025d9dfeb34ef3092f22a3d0d80e38c08e3bf0a79de369284bce9d43a067cd48ee5c9da34ddbd5bba4317

Download Submit