flubot | 4d04c922d7d03c53e603ec4c155ce497a945d86c41f6747e3eed39e4e06d43b9

Resubmissions

22-10-2021 12:26

211022-pl9xlscebm 10

22-10-2021 12:24

211022-plhs5acebl 7

Analysis

max time kernel
2819203s
platform
android_x86
resource
android-x86-arm
submitted
22-10-2021 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.apk
Size

6.1MB
MD5

1a2a4044cf18eed59e66c413db766145
SHA1

4e6e9995c3792d8cbcdd8aeb762bb0a6f74cef68
SHA256

30937927e8891f8c0fd2c7b6be5fbc5a05011c34a7375e91aad384b82b9e6a67
SHA512

cc069b2cc2e3c55190b0c840d98b2f6612e7779c759a24dfd903d96a028f5375ef806c40910efb98d566cef276557dab5cba13397cedc9a1ad56c1d2e1727ae8

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 3 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json	family_flubot
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json	family_flubot
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json	family_flubot

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.tencent.mm

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.mm/system/bin/dex2oat

ioc	pid	process
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json	4834	com.tencent.mm
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json	4877	/system/bin/dex2oat
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json	4834	com.tencent.mm

Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.tencent.mm

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.tencent.mm
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.mm

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.mm

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.tencent.mm

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4834

com.tencent.mm
2⤵
PID:4877

/system/bin/dex2oat
2⤵
- Loads dropped Dex/Jar
PID:4877

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json
MD5
9176c3e392a554fec7890533a61886ab

SHA1
74f83c8167c59c65ad1b508055dfac445bc08c25

SHA256
27ed9910cd1e4f2357df3d687bb8a375b97c1a8655cf0c30a64eff495a9b3b1c

SHA512
ffc4182c020c35d5a44eaf413943115d093ed4640bf9c9fa750c8fd8c6cca8947c1ddce3581b842bdb28588ce7af829dc4e23d1cb7f0b668f5c16c21adb3cbca

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json
MD5
e8b100462913641b3b3ff92e25c28952

SHA1
b6f14c00f93608112d45b67cee5b8b981e575785

SHA256
863a1018014257e0c569c7217dccbd5d810f236e2bb9ffaee02a7e9b3b006437

SHA512
7524ee74a85dfa1c8c4488618e73e56d9e24db1bf99bd03fcea053cbe5c5a26340d1acf0a6d7cac0714e794544b1b551265e8db0176c5d5aa497856f28659974

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json
MD5
9176c3e392a554fec7890533a61886ab

SHA1
74f83c8167c59c65ad1b508055dfac445bc08c25

SHA256
27ed9910cd1e4f2357df3d687bb8a375b97c1a8655cf0c30a64eff495a9b3b1c

SHA512
ffc4182c020c35d5a44eaf413943115d093ed4640bf9c9fa750c8fd8c6cca8947c1ddce3581b842bdb28588ce7af829dc4e23d1cb7f0b668f5c16c21adb3cbca

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads