flubot | 6e3499a5e63209b34ccc787a7ea57953ff5436b51ca4325ea0da4a958f44ea7b

Analysis

max time kernel
1840587s
max time network
166s
platform
android_x64
resource
android-x64-20220310-en
submitted
16-06-2022 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Flubot49.apk
Size

4.3MB
MD5

9ef4f52a6ed459eab6311a4a886ec1ea
SHA1

6380e022ba149c072015389ab634a413f6662530
SHA256

6e3499a5e63209b34ccc787a7ea57953ff5436b51ca4325ea0da4a958f44ea7b
SHA512

34d9e5e63072eab73ea4a1b718d13de94ab277c091c4fa0029ff8f7bb6ea764bfb5520ebede1490ee279e2f823b4b52d10d6a604c0a61cd6ff3e1c8c70cbca98

Score

10^/10

flubot banker discovery infostealer ransomware suricata trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY	family_flubot

suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.tencent.qqpimsecure

ioc pid process

/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY 6173 com.tencent.qqpimsecure
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.qqpimsecure

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.qqpimsecure

ioc	pid	process
/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY	6173	com.tencent.qqpimsecure

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.qqpimsecure

com.tencent.qqpimsecure
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:6173

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY

Filesize
2.3MB

MD5
ca37fa588bf05ffa3726f23c86899425

SHA1
ea12a1452f29f4f1230fb60daf41ccf5776f4306

SHA256
789364348b5311ec2d8a529b05527c90f0fc38222f771f6e5ffa6ebddc1cf82a

SHA512
84e49a98dbd7e57a0d6ca14aaf64c92a4edad9aafd3995f5f18e2d800e7f252dffa4f148f8b3df01701e311ca891a7b686b3e243db16563e0ed5aaec1d21e275

Download Submit
/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/tmp-base.apk.hYfhdah1749666252316755427.jlY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/zalobfpo.njhv

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqpimsecure/shared_prefs/multidex.version.xml

Filesize
307B

MD5
81fb4ac279ae0e7f27c538fe90446b25

SHA1
1d862122c2936e8c838e8ddfc17a66e6bd7e3d2a

SHA256
62294c4d9dfe66db2f8255a027f28ed89b25647415a2532df95281062c8ea593

SHA512
8d11e65a99e161dd2a64aed04bc1fac2978fe6b0dc744869be432115ca9e2fea2646e84b1acfa7b927cd524f1f4df310aaae2d2ef9182f1541cfdc07c6f0e7b6

Download Submit