flubot | 1330f6b64e47a7b7b8653229bd122467329f9bfe7b5cc3218d703cf1bb41420e

General

Target

1330f6b64e47a7b7b8653229bd122467329f9bfe7b5cc3218d703cf1bb41420e.apk
Size

6.2MB
MD5

57d035c7e3688b9f5e009e66da7e8372
SHA1

06672e330825319e1c435feed1dfdd63bd38ade0
SHA256

1330f6b64e47a7b7b8653229bd122467329f9bfe7b5cc3218d703cf1bb41420e
SHA512

03ae2f10f625bbc06749b2a90b28699763e1deb034123fedb6d92f539e79d896b317a79bb262c44803c5cb2421ef7c66ef6585ec5a5883f5bb38cc6acbe8099b

Score

10^/10

flubot banker discovery evasion infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5341-0.dex	family_flubot
behavioral1/memory/5205-0.dex	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.snda.wifilocating

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.snda.wifilocating
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.snda.wifilocating
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.snda.wifilocating

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/base.apk.Gu9tkgu1.8fj --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/oat/x86/base.apk.Gu9tkgu1.odex --compiler-filter=quicken --class-loader-context=&com.snda.wifilocating

ioc	pid	Process
/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/base.apk.Gu9tkgu1.8fj	5341	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/base.apk.Gu9tkgu1.8fj --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/oat/x86/base.apk.Gu9tkgu1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/base.apk.Gu9tkgu1.8fj	5205	com.snda.wifilocating

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
78	api64.ipify.org

Removes a system notification. 1 IoCs

evasion

Processes:

com.snda.wifilocating

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.snda.wifilocating

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

Processes:

com.snda.wifilocating

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.snda.wifilocating

com.snda.wifilocating
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5205
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/base.apk.Gu9tkgu1.8fj --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/oat/x86/base.apk.Gu9tkgu1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5341

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/base.apk.Gu9tkgu1.8fj

Filesize
2.0MB

MD5
bc21df566f1770b0240b848dfd1ff39d

SHA1
21a1796a2f2572ac38533e63073d3f123642198d

SHA256
78c617052a20163e99aaaddc7b74675a09f5ac2bfb3a39b08dd0bf974f9e273a

SHA512
7332c2bd6c9cc45518ddad068c955eb4070ded71955198ab172dd3b6967499a8d3513a94df9f580c29f6dacd5ec47e8f95b241b2d78cd29dcab7198d7463a674

Download Submit
/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/base.apk.Gu9tkgu1.8fj

Filesize
2.0MB

MD5
bc21df566f1770b0240b848dfd1ff39d

SHA1
21a1796a2f2572ac38533e63073d3f123642198d

SHA256
78c617052a20163e99aaaddc7b74675a09f5ac2bfb3a39b08dd0bf974f9e273a

SHA512
7332c2bd6c9cc45518ddad068c955eb4070ded71955198ab172dd3b6967499a8d3513a94df9f580c29f6dacd5ec47e8f95b241b2d78cd29dcab7198d7463a674

Download Submit
/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/base.apk.Gu9tkgu1.8fj.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/khIyg7gg.yhyh

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/oat/x86/base.apk.Gu9tkgu1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/oat/x86/base.apk.Gu9tkgu1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/Gg8gIgf7GI/yhgegGGfjuIg88q/tmp-base.apk.Gu9tkgu6885376619487992966.8fj

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads