flubot | cb8d182e01219a2a2cf8e568e48035b2bf568541b6c19a2f825b630217c80951 | Triage

Analysis

max time kernel
3614114s
max time network
159s
platform
android_x64
resource
android-x64
submitted
08-02-2022 00:26

Sharing

Report Analysis Logs

General

Target

cb8d182e01219a2a2cf8e568e48035b2bf568541b6c19a2f825b630217c80951.apk
Size

3.9MB
MD5

bab9fe33412988558aa3d9643ca56019
SHA1

9a4a36a4e0fb8094091c7e34e0fb33b8d539a6e6
SHA256

cb8d182e01219a2a2cf8e568e48035b2bf568541b6c19a2f825b630217c80951
SHA512

73b00482812c7dcf9e53e0309b4f82ec4ec6ae7b502843693f65370edd9f60bea0a6c355f2d616af4065a3b3690490fe73093b0f691018e2c31791a02fd3df3f

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3802-0.dex	family_flubot
behavioral2/memory/3802-1.dex	family_flubot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	3802	com.tencent.mm
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	3802	com.tencent.mm

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:3802

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads