flubot | 607ceb008d54328c885339fc2d793286834e887b2a328129455343bb8867698b

General

Target

607ceb008d54328c885339fc2d793286834e887b2a328129455343bb8867698b.apk
Size

4.3MB
MD5

a45dc99d0d146524d608691f86d00d63
SHA1

563551eeb18bd5c2889d3ce98462912148189d0f
SHA256

607ceb008d54328c885339fc2d793286834e887b2a328129455343bb8867698b
SHA512

a6e6cb676e89c581f2343cf7e3bb2dc1744e8038a063bc5cf17d3ab53df3a1e3dd6b0c8edab58982ee48518be0d488a47454b639a0a6a67be1d1cd1609d0a2b6

Score

10^/10

flubot banker discovery infostealer ransomware suricata trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/base.apk.teyzojm1.hky	family_flubot
/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/base.apk.teyzojm1.hky	family_flubot

suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.tencent.qqmusic

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.qqmusic

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/base.apk.teyzojm1.hky --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/oat/x86/base.apk.teyzojm1.odex --compiler-filter=quicken --class-loader-context=&com.tencent.qqmusic

ioc	pid	process
/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/base.apk.teyzojm1.hky	5368	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/base.apk.teyzojm1.hky --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/oat/x86/base.apk.teyzojm1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/base.apk.teyzojm1.hky	5318	com.tencent.qqmusic

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.qqmusic

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.qqmusic

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.qqmusic

com.tencent.qqmusic
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:5318
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/base.apk.teyzojm1.hky --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/oat/x86/base.apk.teyzojm1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/base.apk.teyzojm1.hky

Filesize
2.3MB

MD5
70cbd26c9a1d0a0f76332efb22e64746

SHA1
7bac2a9e861747674a7c0c11f8b91986f1759626

SHA256
955bdcd967061a4f7e049c371aa3999b9eb8f844a98abca267109aa4a1aadfd8

SHA512
9dd16632da7922d98d7f65a9ba35fc834c76c5dfd2e34adf14428888134f99a3dcde06aeacc5558f094a6ab4fd9fee16a3369cbb45a98c60404f5959600cc8b2

Download Submit
/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/base.apk.teyzojm1.hky

Filesize
2.3MB

MD5
1185f85a8860af51d2058a5cb50f7c28

SHA1
eb67e73cadc6c5fc287840c58c2ffd8b2aa8d7ee

SHA256
8358a81277a297879a65f54c78eecba9987003e9c16ca287e4e51009b78550fa

SHA512
2069548d04bcf16d82e88fa21a776061336e0ab5bc2935e822ed82f1eaf82662b696372fcf002d498ea6c2ee9ae8e6287b057e85bc3366fb4675b304114330f2

Download Submit
/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/base.apk.teyzojm1.hky.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/hYjqgjlu.marc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/oat/x86/base.apk.teyzojm1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/oat/x86/base.apk.teyzojm1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqmusic/YdrkGfnfll/hhblvjbvfldfdku/tmp-base.apk.teyzojm2382750927674246711.hky

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.qqmusic/shared_prefs/multidex.version.xml

Filesize
306B

MD5
8a3e882990857f7c98b28b0d24286ca4

SHA1
11cb217eb0d761d2fa0a0f0578afdf4af590ce4c

SHA256
bd44b8efd6409076a136d30b3e0b1cd878007a127c343e515e7b0ecec4476ca7

SHA512
e57a628e000eb86fe0f284bd5927c7259a10a314b1d452a581fdb361055b55c434ef7f0cd11dca26977f5f097b7ab870573da9ad36655af24927e7ee92bf9b4c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads