Overview

overview

10

Static

static

7

Flubot49.apk

android_x86

10

Flubot49.apk

android_x64

10

Flubot49.apk

android_x64

10

Analysis

  • max time kernel
    1840589s
  • max time network
    166s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220310-en
  • submitted
    16-06-2022 18:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Flubot49.apk

  • Size

    4.3MB

  • MD5

    9ef4f52a6ed459eab6311a4a886ec1ea

  • SHA1

    6380e022ba149c072015389ab634a413f6662530

  • SHA256

    6e3499a5e63209b34ccc787a7ea57953ff5436b51ca4325ea0da4a958f44ea7b

  • SHA512

    34d9e5e63072eab73ea4a1b718d13de94ab277c091c4fa0029ff8f7bb6ea764bfb5520ebede1490ee279e2f823b4b52d10d6a604c0a61cd6ff3e1c8c70cbca98

Score
10/10
flubotbankerdiscoveryinfostealerransomwaresuricatatrojan

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

    bankertrojaninfostealerflubot
  • FluBot Payload 1 IoCs
  • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata
  • Makes use of the framework's Accessibility service. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.tencent.qqpimsecure
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:6254

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/base.apk.hYfhdah1.jlY
    Filesize

    2.3MB

    MD5

    ca37fa588bf05ffa3726f23c86899425

    SHA1

    ea12a1452f29f4f1230fb60daf41ccf5776f4306

    SHA256

    789364348b5311ec2d8a529b05527c90f0fc38222f771f6e5ffa6ebddc1cf82a

    SHA512

    84e49a98dbd7e57a0d6ca14aaf64c92a4edad9aafd3995f5f18e2d800e7f252dffa4f148f8b3df01701e311ca891a7b686b3e243db16563e0ed5aaec1d21e275

    Download Submit

  • /data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/tmp-base.apk.hYfhdah2999506782821158968.jlY
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.tencent.qqpimsecure/jasbjdxpfb/hnzboYGcfmmpfns/zalobfpo.njhv
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.tencent.qqpimsecure/shared_prefs/multidex.version.xml
    Filesize

    307B

    MD5

    17969a6bd50405e535762ff8e216be3d

    SHA1

    8da8ff3cea01c471da0a3f836e924eb777cb96d2

    SHA256

    4f98ee3564040e1d3ece288c3d9eec73a506392b1367958ac86ac5700c9e1fb9

    SHA512

    91eb377773364070b878cf835d373be2adc3d8e5db4dea1101086c46d08166c2b49504d903651e57b5068b8a113279409b90d20c70acdb2901f3e233cee1b120

    Download Submit