flubot | 7c92b5617af4da664343684530e88639e0624f21c53a2cadc61a1e6a57fc29d7

Analysis

max time kernel
1842931s
max time network
78s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
16-06-2022 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c92b5617af4da664343684530e88639e0624f21c53a2cadc61a1e6a57fc29d7.apk
Size

4.1MB
MD5

3acf9f6b6a813d018d643263766f06b5
SHA1

10bfc1b6b540b56386c335bff1399f20f63eafc9
SHA256

7c92b5617af4da664343684530e88639e0624f21c53a2cadc61a1e6a57fc29d7
SHA512

db814c7c68e3b837954e3f662e1874e7909b1eca3e008ed789c91ecfceaea6f2e403d9388602f5459b043879392bdf03774bb70d6e862515f230ea9bbb8a3f96

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 4 IoCs

Processes:

resource	yara_rule
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	family_flubot
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	family_flubot
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	family_flubot
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	family_flubot

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.bilibili.app.in

ioc	pid	process
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	6928	com.bilibili.app.in
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	6928	com.bilibili.app.in
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	6928	com.bilibili.app.in

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.bilibili.app.in

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.bilibili.app.in

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.bilibili.app.in

com.bilibili.app.in
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:6928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc

Filesize
4.7MB

MD5
ea3531805c0577d24c0fb6797808e41e

SHA1
db0318d2b6d223fcfbbdeafb6ed62f6a26ffca5f

SHA256
2df449e734c6220d13fc3a9f26db497df413cd593675b6ee51ba95935c8e60b4

SHA512
6f560c00e813b287078300f4a52dc3f076052dceb920021f3ae1dd25d5048064ab956160a870ca732b0475beccd0f18bd536a78f645f23072c43fc3687ccc0ba

Download Submit
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc

Filesize
4.7MB

MD5
ea3531805c0577d24c0fb6797808e41e

SHA1
db0318d2b6d223fcfbbdeafb6ed62f6a26ffca5f

SHA256
2df449e734c6220d13fc3a9f26db497df413cd593675b6ee51ba95935c8e60b4

SHA512
6f560c00e813b287078300f4a52dc3f076052dceb920021f3ae1dd25d5048064ab956160a870ca732b0475beccd0f18bd536a78f645f23072c43fc3687ccc0ba

Download Submit
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc

Filesize
4.7MB

MD5
ea3531805c0577d24c0fb6797808e41e

SHA1
db0318d2b6d223fcfbbdeafb6ed62f6a26ffca5f

SHA256
2df449e734c6220d13fc3a9f26db497df413cd593675b6ee51ba95935c8e60b4

SHA512
6f560c00e813b287078300f4a52dc3f076052dceb920021f3ae1dd25d5048064ab956160a870ca732b0475beccd0f18bd536a78f645f23072c43fc3687ccc0ba

Download Submit
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc

Filesize
4.7MB

MD5
ea3531805c0577d24c0fb6797808e41e

SHA1
db0318d2b6d223fcfbbdeafb6ed62f6a26ffca5f

SHA256
2df449e734c6220d13fc3a9f26db497df413cd593675b6ee51ba95935c8e60b4

SHA512
6f560c00e813b287078300f4a52dc3f076052dceb920021f3ae1dd25d5048064ab956160a870ca732b0475beccd0f18bd536a78f645f23072c43fc3687ccc0ba

Download Submit