flubot | 8fd1dbdb76379205f545cb4262e36e2b486d52f604367121ec39e112e62d2efa

Analysis

max time kernel
1840641s
max time network
150s
platform
android_x64
resource
android-x64-20220310-en
submitted
16-06-2022 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fd1dbdb76379205f545cb4262e36e2b486d52f604367121ec39e112e62d2efaa.apk
Size

4.5MB
MD5

2b26b4dd18ca1d2f588fc95b2e09fdd9
SHA1

63520604747d2a09104cd0dd20bc8c6e4c42f3a0
SHA256

8fd1dbdb76379205f545cb4262e36e2b486d52f604367121ec39e112e62d2efa
SHA512

e5ce70694416b6540fa4f867a0cc9fd16d28981645fd861e6c9425bc0c221a4e38b20e0e1a9606e073c54ae11fba2f24c7dfb863e51023dc812a93f30f1a062d

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 4 IoCs

Processes:

resource	yara_rule
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	family_flubot
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	family_flubot
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	family_flubot
/data/data/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	family_flubot

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.bilibili.app.in

ioc	pid	process
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	6296	com.bilibili.app.in
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	6296	com.bilibili.app.in
/data/data/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	6296	com.bilibili.app.in

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.bilibili.app.in

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.bilibili.app.in

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.bilibili.app.in

com.bilibili.app.in
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:6296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi

Filesize
4.7MB

MD5
554c059a775d682f11e77ad941e1f436

SHA1
2ec6a5d1b82289e8d8f7973ac2cd5d479f714890

SHA256
5710732441308f8016698f594b7ae7461b58992846bf25b83070f4addb7881fd

SHA512
51c64948b0e4faf2040d11d62811fe1e47faa1580865b22dde9e13cadc4d260dfa60064e87bfc4dbe6d5921fa8ca64d51bcd000588abfd674ddaa63d0c819c48

Download Submit
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi

Filesize
4.7MB

MD5
554c059a775d682f11e77ad941e1f436

SHA1
2ec6a5d1b82289e8d8f7973ac2cd5d479f714890

SHA256
5710732441308f8016698f594b7ae7461b58992846bf25b83070f4addb7881fd

SHA512
51c64948b0e4faf2040d11d62811fe1e47faa1580865b22dde9e13cadc4d260dfa60064e87bfc4dbe6d5921fa8ca64d51bcd000588abfd674ddaa63d0c819c48

Download Submit
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi

Filesize
4.7MB

MD5
554c059a775d682f11e77ad941e1f436

SHA1
2ec6a5d1b82289e8d8f7973ac2cd5d479f714890

SHA256
5710732441308f8016698f594b7ae7461b58992846bf25b83070f4addb7881fd

SHA512
51c64948b0e4faf2040d11d62811fe1e47faa1580865b22dde9e13cadc4d260dfa60064e87bfc4dbe6d5921fa8ca64d51bcd000588abfd674ddaa63d0c819c48

Download Submit
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi

Filesize
4.7MB

MD5
554c059a775d682f11e77ad941e1f436

SHA1
2ec6a5d1b82289e8d8f7973ac2cd5d479f714890

SHA256
5710732441308f8016698f594b7ae7461b58992846bf25b83070f4addb7881fd

SHA512
51c64948b0e4faf2040d11d62811fe1e47faa1580865b22dde9e13cadc4d260dfa60064e87bfc4dbe6d5921fa8ca64d51bcd000588abfd674ddaa63d0c819c48

Download Submit