flubot | fe52bed001f28a4b218bcd0ad31b92fb59022778cf68a1445cf3e8c612a5e04c

Analysis

max time kernel
2747163s
max time network
154s
platform
android_x64
resource
android-x64-arm64-20220621-en
submitted
27-06-2022 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe52bed001f28a4b218bcd0ad31b92fb59022778cf68a1445cf3e8c612a5e04c.apk
Size

4.2MB
MD5

37be18494cd03ea70a1fdd6270cef6e3
SHA1

4714aaa5195da29c6e74aeee9e9f19678af5c15b
SHA256

fe52bed001f28a4b218bcd0ad31b92fb59022778cf68a1445cf3e8c612a5e04c
SHA512

5452d2e545c46b94d3209b332fea6e87727039371688e2ae63ad303c014db5e7b5d4222d4dcefd703fc4a4f15e6f685ec5e62cabe396573bed0e0f78a40d679f

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 4 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood	family_flubot
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood	family_flubot
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood	family_flubot
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood	family_flubot

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.mobileqq

ioc	pid	process
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood	5100	com.tencent.mobileqq
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood	5100	com.tencent.mobileqq
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood	5100	com.tencent.mobileqq

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.mobileqq

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.mobileqq

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mobileqq

com.tencent.mobileqq
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:5100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood

Filesize
6.5MB

MD5
4f3fd634a3822ebc963297b1c6e02f62

SHA1
c7dba2509d53b8b3ad9b526b9e46ad32db3f1eab

SHA256
6c0bd313d36ac2d0180a8ccd6d7416fc7f0f56781e00128af6a67772d46707d6

SHA512
6f58bc4a947e1533df435e6b7f5f9380f022e821e596fbc7939f99a9f63fda73e3b5869834a6b994c421db8ac5f15859e78ab57274ddb009e952688cd5106b41

Download Submit
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood

Filesize
6.5MB

MD5
4f3fd634a3822ebc963297b1c6e02f62

SHA1
c7dba2509d53b8b3ad9b526b9e46ad32db3f1eab

SHA256
6c0bd313d36ac2d0180a8ccd6d7416fc7f0f56781e00128af6a67772d46707d6

SHA512
6f58bc4a947e1533df435e6b7f5f9380f022e821e596fbc7939f99a9f63fda73e3b5869834a6b994c421db8ac5f15859e78ab57274ddb009e952688cd5106b41

Download Submit
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood

Filesize
6.5MB

MD5
4f3fd634a3822ebc963297b1c6e02f62

SHA1
c7dba2509d53b8b3ad9b526b9e46ad32db3f1eab

SHA256
6c0bd313d36ac2d0180a8ccd6d7416fc7f0f56781e00128af6a67772d46707d6

SHA512
6f58bc4a947e1533df435e6b7f5f9380f022e821e596fbc7939f99a9f63fda73e3b5869834a6b994c421db8ac5f15859e78ab57274ddb009e952688cd5106b41

Download Submit
/data/user/0/com.tencent.mobileqq/app_apkprotector_dex/ISM4bLeG.ood

Filesize
6.5MB

MD5
4f3fd634a3822ebc963297b1c6e02f62

SHA1
c7dba2509d53b8b3ad9b526b9e46ad32db3f1eab

SHA256
6c0bd313d36ac2d0180a8ccd6d7416fc7f0f56781e00128af6a67772d46707d6

SHA512
6f58bc4a947e1533df435e6b7f5f9380f022e821e596fbc7939f99a9f63fda73e3b5869834a6b994c421db8ac5f15859e78ab57274ddb009e952688cd5106b41

Download Submit