flubot | e93a4e8bec4e2bf47157e55be150c8fb62c38cd4ca180b473f53259fa44cdd48

General

Target

e93a4e8bec4e2bf47157e55be150c8fb62c38cd4ca180b473f53259fa44cdd48.apk
Size

4.2MB
MD5

58fe07645a418f93efeeeacb04dd16c0
SHA1

62a5e53b179e4b6b66f8094db788afd2e3eb550f
SHA256

e93a4e8bec4e2bf47157e55be150c8fb62c38cd4ca180b473f53259fa44cdd48
SHA512

2b358681bc4429b34d5777f9f778a056addfd26d0497a9a5282ead8f83cbb2845b292b3fbbd4096925b39d0dd08103d586afff7b6e7a183d5f34c8ac31a44e11

Score

10^/10

flubot banker discovery infostealer ransomware suricata trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/base.apk.ffffhss1.jhd	family_flubot
/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/base.apk.ffffhss1.jhd	family_flubot

suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.qiyi.video

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.qiyi.video

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/base.apk.ffffhss1.jhd --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/oat/x86/base.apk.ffffhss1.odex --compiler-filter=quicken --class-loader-context=&com.qiyi.video

ioc	pid	process
/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/base.apk.ffffhss1.jhd	5361	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/base.apk.ffffhss1.jhd --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/oat/x86/base.apk.ffffhss1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/base.apk.ffffhss1.jhd	5207	com.qiyi.video

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.qiyi.video

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.qiyi.video

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.qiyi.video

com.qiyi.video
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:5207
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/base.apk.ffffhss1.jhd --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/oat/x86/base.apk.ffffhss1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5361

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/base.apk.ffffhss1.jhd

Filesize
2.3MB

MD5
e4e94c01b206822956efb73c43126865

SHA1
d7d682de479e5354f7d4ef366d6ebf74088d3aef

SHA256
535a4d7b63e312957f4774e7359b3eae1c519d65cb7612e9960869617aacb0eb

SHA512
f5b4449026b79060cca0d30925c05abece30a453e9fdf54303b703b6947f4d092ead466f4616f1795a4428a1867323271d2410c11a7f30ad689a237418118331

Download Submit
/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/base.apk.ffffhss1.jhd

Filesize
2.3MB

MD5
dd62e312a1d44d6a0fa4aceeef1816be

SHA1
e95f766465f9422c368d396abf0a71d3e89f9acc

SHA256
63d31005d25172a341177dff397fb50469fe0434a8966eb73bc57eb7b6e60883

SHA512
c92d50a6db6da41cb94747f10d1426407268033ded04aab920efdc00aa334fe1680d5dcb6c00b007d8a12a2afccd7b990c64bc940fde634809ee3a668651d608

Download Submit
/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/base.apk.ffffhss1.jhd.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/gGablnsh.hapb

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/oat/x86/base.apk.ffffhss1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/oat/x86/base.apk.ffffhss1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qiyi.video/hYzjfhnzkh/xhggmbshcbxjzkf/tmp-base.apk.ffffhss6452004210566397186.jhd

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qiyi.video/shared_prefs/multidex.version.xml

Filesize
305B

MD5
827b75ab67cba913a121be3bf682b651

SHA1
a70e24905f115f9eea85878319f1262dead8dc2a

SHA256
40b01659aaa42ee8d3d6bf10d2d6c7a991e27ae520bd85230df58dd4bc137018

SHA512
135ddc3d4894cb4897393f20a1971d3f38cf4ea1b3230e28eeb792634253f0f0df4a741c0de7c4336ebda95c3ab7eae2b554bc3ffe9ed296f08666ce13b98d7d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads