flubot | 6a03efa4ffa38032edfb5b604672e8c9e01a324f8857b5848e8160593dfb325e

Analysis

max time kernel
1835111s
max time network
59s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
16-06-2022 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a03efa4ffa38032edfb5b604672e8c9e01a324f8857b5848e8160593dfb325e.apk
Size

4.0MB
MD5

1edd97885a8a7e88694be9971ac317e5
SHA1

64c4b39176709a7fa9be936b925b17fb53544da9
SHA256

6a03efa4ffa38032edfb5b604672e8c9e01a324f8857b5848e8160593dfb325e
SHA512

2aa25bae46e2c3f1ebdd2360c378f711ebc40fe82f9541d6a52d48f3ee14f46801a7125d6b02afdeaa342dfd96b6b22017cf7011e81fad749ce864b1703a077a

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 4 IoCs

Processes:

resource	yara_rule
behavioral3/files/6228-0.dat	family_flubot
behavioral3/memory/6228-0.dex	family_flubot
behavioral3/memory/6228-1.dex	family_flubot
behavioral3/memory/6228-2.dex	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.weico.international

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.weico.international
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.weico.international
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.weico.international

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.weico.international

ioc	pid	Process
/data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws	6228	com.weico.international
/data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws	6228	com.weico.international
/data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws	6228	com.weico.international

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

Processes:

com.weico.international

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.weico.international

com.weico.international
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:6228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws

Filesize
2.7MB

MD5
b1d614416713cac32114408e34bf65f8

SHA1
6d359cdd25d13b7e407c60301ceec5d276b3580c

SHA256
43aeff13359ef7e32a451cd4b92c92a0fe1e1379529908da360ad52ab536edee

SHA512
ef8b04cd045b89ef6ad4e1ecffa8dd45e7c7adc9a35e1f9648c13bc6c3fa1b916ef8fc592990806755801df460932c128a49836962d5a614858e3c695625786f

Download Submit
/data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws

Filesize
2.7MB

MD5
b1d614416713cac32114408e34bf65f8

SHA1
6d359cdd25d13b7e407c60301ceec5d276b3580c

SHA256
43aeff13359ef7e32a451cd4b92c92a0fe1e1379529908da360ad52ab536edee

SHA512
ef8b04cd045b89ef6ad4e1ecffa8dd45e7c7adc9a35e1f9648c13bc6c3fa1b916ef8fc592990806755801df460932c128a49836962d5a614858e3c695625786f

Download Submit
/data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws

Filesize
2.7MB

MD5
b1d614416713cac32114408e34bf65f8

SHA1
6d359cdd25d13b7e407c60301ceec5d276b3580c

SHA256
43aeff13359ef7e32a451cd4b92c92a0fe1e1379529908da360ad52ab536edee

SHA512
ef8b04cd045b89ef6ad4e1ecffa8dd45e7c7adc9a35e1f9648c13bc6c3fa1b916ef8fc592990806755801df460932c128a49836962d5a614858e3c695625786f

Download Submit
/data/user/0/com.weico.international/app_apkprotector_dex/5xae4yYD.aws

Filesize
2.7MB

MD5
b1d614416713cac32114408e34bf65f8

SHA1
6d359cdd25d13b7e407c60301ceec5d276b3580c

SHA256
43aeff13359ef7e32a451cd4b92c92a0fe1e1379529908da360ad52ab536edee

SHA512
ef8b04cd045b89ef6ad4e1ecffa8dd45e7c7adc9a35e1f9648c13bc6c3fa1b916ef8fc592990806755801df460932c128a49836962d5a614858e3c695625786f

Download Submit