flubot | 16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19

Analysis

max time kernel
1845869s
max time network
159s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
16-06-2022 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19a.apk
Size

3.3MB
MD5

7e97532091767c01d5b426c4d0726fff
SHA1

99828b200a44302507ed272c3fad84cc9747924d
SHA256

16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19
SHA512

7994e440985226af7455f58e1f54bd37ad51fd27999d5c8023d240eb966111fb8058e6dcf183aeb8566d648f5f5d6d22d5f76a016649a7e7f7c5a9729792cb64

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 4 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex	family_flubot
/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex	family_flubot
/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex	family_flubot
/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.tencent.westarthk

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.westarthk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.westarthk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.westarthk

Loads dropped Dex/Jar 6 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.westarthk/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/dp.kotlin-v1.lua.mph --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/oat/x86/dp.kotlin-v1.lua.odex --compiler-filter=quicken --class-loader-context=&/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.tencent.westarthk/app_ded/oat/x86/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/dp.kotlin-v1.lua.mph	5021	com.tencent.westarthk
/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/dp.kotlin-v1.lua.mph	5055	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/dp.kotlin-v1.lua.mph --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/oat/x86/dp.kotlin-v1.lua.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/dp.kotlin-v1.lua.mph	5021	com.tencent.westarthk
/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex	5021	com.tencent.westarthk
/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex	5171	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.tencent.westarthk/app_ded/oat/x86/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex	5021	com.tencent.westarthk

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.westarthk

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.westarthk

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.westarthk

com.tencent.westarthk
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:5021
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/dp.kotlin-v1.lua.mph --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/oat/x86/dp.kotlin-v1.lua.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5055
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.tencent.westarthk/app_ded/oat/x86/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5171

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex

Filesize
1.5MB

MD5
1be07a7baad9b4a2a0580a8e60629658

SHA1
26253e76f2fa7ea97b9d406281fbd1586a1f0aaa

SHA256
f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334

SHA512
c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex

Filesize
1.5MB

MD5
1be07a7baad9b4a2a0580a8e60629658

SHA1
26253e76f2fa7ea97b9d406281fbd1586a1f0aaa

SHA256
f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334

SHA512
c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex

Filesize
1.5MB

MD5
1969f6d1e3afc6031732df24dc4fbdb7

SHA1
fdb2632d99062b994ed8caaad784a6024a02aae3

SHA256
1a075847d0cd3121fde2f8be8397f652b058376a49e8fd77236ba57bee4504a9

SHA512
fdca73ca7080f75460ef366c4a529c85ce095c31fa6d9904f8dd97f62798d892b9c2d37d3b38718f6d76cd3bb62e4fe5fcab121efdb66e44e3928c7cab9543a7

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex

Filesize
1.5MB

MD5
1be07a7baad9b4a2a0580a8e60629658

SHA1
26253e76f2fa7ea97b9d406281fbd1586a1f0aaa

SHA256
f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334

SHA512
c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.dex.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/oat/x86/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/oat/x86/KLMYNThs5snywy0wUkOpLZsZyyoA9eDK.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/cache/src6473795976210061211

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/dp.kotlin-v1.lua.mph

Filesize
120KB

MD5
c384c5cdaf8f3edfa29389f2de2effea

SHA1
5e5dad9692cf5794e3ff7b99a64e6555399bc56f

SHA256
0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

SHA512
7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

Download Submit
/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/dp.kotlin-v1.lua.mph

Filesize
120KB

MD5
c384c5cdaf8f3edfa29389f2de2effea

SHA1
5e5dad9692cf5794e3ff7b99a64e6555399bc56f

SHA256
0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

SHA512
7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

Download Submit
/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/dp.kotlin-v1.lua.mph

Filesize
120KB

MD5
5e0ca1f47d3a8db8a8124c2cc1764665

SHA1
4b12e946982d6734639b598e1c07de978742d57d

SHA256
82bda6c0b3a3a18143df2b9719f11a455bee95300adb6eec16ec3c0cb210edf9

SHA512
447bcbf794f066e711e7d3f517c04d15ec705e4e1e271d82428abb467c888fb3ee5dc235192087f2df7f57baea974a2feb862671f4eb81605468962ace39712b

Download Submit
/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/dp.kotlin-v1.lua.mph

Filesize
120KB

MD5
c384c5cdaf8f3edfa29389f2de2effea

SHA1
5e5dad9692cf5794e3ff7b99a64e6555399bc56f

SHA256
0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

SHA512
7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

Download Submit
/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/dp.kotlin-v1.lua.mph.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/oat/x86/dp.kotlin-v1.lua.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/cache/src6473795976210061211/oat/x86/dp.kotlin-v1.lua.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit