flubot | 4d3ea6e701b950516b89a4be889a31635e9f892705f34345017d323bfcd6e110

Analysis

max time kernel
1841088s
max time network
167s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
16-06-2022 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d3ea6e701b950516b89a4be889a31635e9f892705f34345017d323bfcd6e110.apk
Size

4.0MB
MD5

6f049fc4e5f85d53d1aaa158412edca3
SHA1

d23d638b224dbbdb6ace0bdc3271fc17a924007c
SHA256

4d3ea6e701b950516b89a4be889a31635e9f892705f34345017d323bfcd6e110
SHA512

084ade2f99dbc69de0d4c84535756da2db8f894b56f610826437d80e3747de39a08508c4411f2f2cfeef05639534a13e47e2737e0033c6b881f60781d2d20fde

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 4 IoCs

resource	yara_rule
behavioral3/files/6643-0.dat	family_flubot
behavioral3/memory/6643-0.dex	family_flubot
behavioral3/memory/6643-1.dex	family_flubot
behavioral3/memory/6643-2.dex	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mobileqq
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mobileqq
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mobileqq

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/1ZSxwFVb.k7s	6643	com.tencent.mobileqq
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/1ZSxwFVb.k7s	6643	com.tencent.mobileqq
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/1ZSxwFVb.k7s	6643	com.tencent.mobileqq

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mobileqq

com.tencent.mobileqq
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:6643

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/1ZSxwFVb.k7s

Filesize
2.7MB

MD5
3da316472c35bd207a98bfd04b4244ce

SHA1
4bad0a3c4627a0ebf0bcaa1e327eb243ca9d449e

SHA256
58d6ae1d358508675cf791bbb3de96b8d8c97bbb960bc4075f8899cf2386baf6

SHA512
e9331106619ff5dd8670471fe989d58b35dbf976f59e4fad2c8a07247d348b3eb513d3a0d6ccbb5a7620183062d5a1c30abcc5a5a61c843abd2d5f436b3ce406

Download Submit
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/1ZSxwFVb.k7s

Filesize
2.7MB

MD5
3da316472c35bd207a98bfd04b4244ce

SHA1
4bad0a3c4627a0ebf0bcaa1e327eb243ca9d449e

SHA256
58d6ae1d358508675cf791bbb3de96b8d8c97bbb960bc4075f8899cf2386baf6

SHA512
e9331106619ff5dd8670471fe989d58b35dbf976f59e4fad2c8a07247d348b3eb513d3a0d6ccbb5a7620183062d5a1c30abcc5a5a61c843abd2d5f436b3ce406

Download Submit
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/1ZSxwFVb.k7s

Filesize
2.7MB

MD5
3da316472c35bd207a98bfd04b4244ce

SHA1
4bad0a3c4627a0ebf0bcaa1e327eb243ca9d449e

SHA256
58d6ae1d358508675cf791bbb3de96b8d8c97bbb960bc4075f8899cf2386baf6

SHA512
e9331106619ff5dd8670471fe989d58b35dbf976f59e4fad2c8a07247d348b3eb513d3a0d6ccbb5a7620183062d5a1c30abcc5a5a61c843abd2d5f436b3ce406

Download Submit
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/1ZSxwFVb.k7s

Filesize
2.7MB

MD5
3da316472c35bd207a98bfd04b4244ce

SHA1
4bad0a3c4627a0ebf0bcaa1e327eb243ca9d449e

SHA256
58d6ae1d358508675cf791bbb3de96b8d8c97bbb960bc4075f8899cf2386baf6

SHA512
e9331106619ff5dd8670471fe989d58b35dbf976f59e4fad2c8a07247d348b3eb513d3a0d6ccbb5a7620183062d5a1c30abcc5a5a61c843abd2d5f436b3ce406

Download Submit