flubot | 34d3338408dfd8244ba7ee655f558f0e06e0982cb76584f88707f6d0bdcf6a2c

Analysis

max time kernel
1841590s
max time network
166s
platform
android_x64
resource
android-x64-20220310-en
submitted
16-06-2022 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34d3338408dfd8244ba7ee655f558f0e06e0982cb76584f88707f6d0bdcf6a2c.apk
Size

2.6MB
MD5

6a7e746ade78143f4ca2a7a4ce33f250
SHA1

452abfbc77dc37780b571d0ce4f623ac960d89ff
SHA256

34d3338408dfd8244ba7ee655f558f0e06e0982cb76584f88707f6d0bdcf6a2c
SHA512

d4a82b20a5acf601e36b2c1abcdc1a6275a6baca43746e4a7f525368f1db5e699369efe1c0656172f962b44bb4c2f421bf526d0466e24f094af623e10d546245

Score

10^/10

flubot banker infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.dailyyoga.cn/code_cache/secondary-dexes/base.apk.classes1.zip	family_flubot

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.dailyyoga.cn

ioc pid process

/data/user/0/com.dailyyoga.cn/code_cache/secondary-dexes/base.apk.classes1.zip 6192 com.dailyyoga.cn

ioc	pid	process
/data/user/0/com.dailyyoga.cn/code_cache/secondary-dexes/base.apk.classes1.zip	6192	com.dailyyoga.cn

com.dailyyoga.cn
1⤵
- Loads dropped Dex/Jar
PID:6192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.dailyyoga.cn/code_cache/secondary-dexes/MultiDex.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.dailyyoga.cn/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
2.3MB

MD5
fe87e5323fc5d40f23aa1955d4c5a37b

SHA1
38eb427ab9e25a1b3dbff0ce47ba9165b3b898a0

SHA256
3679c31a8555cf5a7d9c3fa7ed3c7fa6eb14cc03e72b20d6061c77379a52e054

SHA512
4c8d2526d50d60491b39aa29366d0df9bbeef1d14b2f4c4877d64fc0af7c745c1a1c5ba250f94ac924e18dc3960b5889116edcc29539f3b93cdb13754aa9fddd

Download Submit
/data/user/0/com.dailyyoga.cn/code_cache/secondary-dexes/tmp-base.apk.classes6413550487342695252.zip

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.dailyyoga.cn/shared_prefs/multidex.version.xml

Filesize
305B

MD5
1083b64a80f7fbfce4fca1d826ad1349

SHA1
b0b87b756fbaa0fadfc49d7758a36ffe10f71887

SHA256
40c7d1d47f7430cfca9752e4621cc5988d4463169c72315d3cde607781624684

SHA512
0a4151bf3d4af04aca363097b45270766b489a9294704cba994b5369d7ee354b10b7611183c492ffea31e671bf7daa1147b516d36abc9f1a8709df50af43cede

Download Submit