flubot | 6e3499a5e63209b34ccc787a7ea57953ff5436b51ca4325ea0da4a958f44ea7b

General

Target

Flubot49.apk
Size

4.3MB
MD5

9ef4f52a6ed459eab6311a4a886ec1ea
SHA1

6380e022ba149c072015389ab634a413f6662530
SHA256

6e3499a5e63209b34ccc787a7ea57953ff5436b51ca4325ea0da4a958f44ea7b
SHA512

34d9e5e63072eab73ea4a1b718d13de94ab277c091c4fa0029ff8f7bb6ea764bfb5520ebede1490ee279e2f823b4b52d10d6a604c0a61cd6ff3e1c8c70cbca98

Score

10^/10

flubot banker discovery infostealer ransomware suricata trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY	family_flubot
/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY	family_flubot

suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.tencent.qqpimsecure

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.qqpimsecure

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/oat/x86/base.apk.hYfhdah1.odex --compiler-filter=quicken --class-loader-context=&com.tencent.qqpimsecure

ioc	pid	process
/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY	5358	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/oat/x86/base.apk.hYfhdah1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY	5316	com.tencent.qqpimsecure

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.qqpimsecure

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.qqpimsecure

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.qqpimsecure

com.tencent.qqpimsecure
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:5316
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/oat/x86/base.apk.hYfhdah1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5358

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY

Filesize
2.3MB

MD5
89fff2b0e27522126e88d6db3413d018

SHA1
908af0edd292b0293785caa90b2d05b57a2780db

SHA256
8e16aefa22d8b350bc2fa98d62495d69b015099fb0ac120d016a27dded6a83fc

SHA512
ba31cb11daea49326c97937ed6966135e60a11ef70c1be5d5eea6db05da09d5944cbee7328e4b1a2da573012615ce5494d4a64fa11c1091342cce9f9322ceb73

Download Submit
/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY

Filesize
2.3MB

MD5
ca37fa588bf05ffa3726f23c86899425

SHA1
ea12a1452f29f4f1230fb60daf41ccf5776f4306

SHA256
789364348b5311ec2d8a529b05527c90f0fc38222f771f6e5ffa6ebddc1cf82a

SHA512
84e49a98dbd7e57a0d6ca14aaf64c92a4edad9aafd3995f5f18e2d800e7f252dffa4f148f8b3df01701e311ca891a7b686b3e243db16563e0ed5aaec1d21e275

Download Submit
/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/oat/x86/base.apk.hYfhdah1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/oat/x86/base.apk.hYfhdah1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/tmp-base.apk.hYfhdah2895400292925418646.jlY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/zalobfpo.njhv

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqpimsecure/shared_prefs/multidex.version.xml

Filesize
307B

MD5
ce845a640ee3ded11d8b22daf3c5adf2

SHA1
f4993ff551592a53ce216f50f34fc93dce80ca52

SHA256
e7eb59a09fe06ee4812f10c8d960a41eb0a9ba026d27d418937b205c795f53dd

SHA512
b4e0981c6bb81248389197a50767ec9dc2b12060db44e9d5d4f007ab1e662ddbe2ee766f59175bcf44af3e9d0a1039e34a873545252c0fcaf16af664bfc55ebc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads