flubot | 36158735c5442bb6a2f5432226403905551f360d7ce99fa51e9d2b54b7cd02e7

General

Target

Flubot_1.apk
Size

5.0MB
MD5

5e3fb4a6f144335016f5d0773b0113fd
SHA1

1a555e9e7f65ebe7ab2c6a48e126c63bb38e7612
SHA256

36158735c5442bb6a2f5432226403905551f360d7ce99fa51e9d2b54b7cd02e7
SHA512

cd0aeedac720253a5ef1afbdfdaed7c7db9efa13c3423c329a83917746ca9cdc968ab4c01f2ee07dac6093a497d6224c0849348ade75d51b635411bf280ad340

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/base.apk.ki5fhf91.hre	family_flubot
/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/base.apk.ki5fhf91.hre	family_flubot

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.snda.wifilocating

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.snda.wifilocating

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/base.apk.ki5fhf91.hre --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/oat/x86/base.apk.ki5fhf91.odex --compiler-filter=quicken --class-loader-context=&com.snda.wifilocating

ioc	pid	process
/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/base.apk.ki5fhf91.hre	5110	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/base.apk.ki5fhf91.hre --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/oat/x86/base.apk.ki5fhf91.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/base.apk.ki5fhf91.hre	5000	com.snda.wifilocating

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.snda.wifilocating

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.snda.wifilocating

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.snda.wifilocating

com.snda.wifilocating
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:5000
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/base.apk.ki5fhf91.hre --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/oat/x86/base.apk.ki5fhf91.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5110

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/base.apk.ki5fhf91.hre

Filesize
2.0MB

MD5
3231abf45dda8eabf4554dfca61af489

SHA1
02c74432bcc3b377578ccd9906a67bdf42f31bc1

SHA256
0e8e17046fed1d67c50ab29ed8588f19747b466158b57816fde1a88cfcddd5ef

SHA512
630427645277d5dfb700daa8cf7b38af0b0b34c5c13b011d41602be803e999f5ba29b58053d6083f2e583d9555f6a9e1808158cc207edfb38ed7ad8d2bddbc13

Download Submit
/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/base.apk.ki5fhf91.hre

Filesize
2.0MB

MD5
3231abf45dda8eabf4554dfca61af489

SHA1
02c74432bcc3b377578ccd9906a67bdf42f31bc1

SHA256
0e8e17046fed1d67c50ab29ed8588f19747b466158b57816fde1a88cfcddd5ef

SHA512
630427645277d5dfb700daa8cf7b38af0b0b34c5c13b011d41602be803e999f5ba29b58053d6083f2e583d9555f6a9e1808158cc207edfb38ed7ad8d2bddbc13

Download Submit
/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/base.apk.ki5fhf91.hre.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/hoxxfrv4.zsbm

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/oat/x86/base.apk.ki5fhf91.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/oat/x86/base.apk.ki5fhf91.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/cJyl9g9uhh/udnb5JfccJukvhh/tmp-base.apk.ki5fhf97960816119199405812.hre

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads