flubot | cba063482ec7bac26001b67f468d84f13edf2685fd07a3103a85e71ac9ef56fb

Analysis

max time kernel
4093538s
max time network
158s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
31-08-2022 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cba063482ec7bac26001b67f468d84f13edf2685fd07a3103a85e71ac9ef56fb.apk
Size

3.9MB
MD5

55f8d0195d943a60f7bfb33681613a12
SHA1

d064048e1990d927dbb025b1a7deb77044fcdf91
SHA256

cba063482ec7bac26001b67f468d84f13edf2685fd07a3103a85e71ac9ef56fb
SHA512

9bdb5f87316e6ef94340a0e38fdc992bea4fe324f48942dc05474671763f833d02472a4b700aa8ba702585caacc29f99649cf3a5f314257b82fc58f76439bcc8
SSDEEP

98304:WzaPliKtfPe0pPJZ4NAL+KKaHI2HxdXnWi7w:aAib0pPX4qL+H2HSik

Score

10^/10

flubot banker discovery evasion infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/base.apk.u6rU68r1.kgs	family_flubot
/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/base.apk.u6rU68r1.kgs	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.snda.wifilocating

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.snda.wifilocating
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.snda.wifilocating
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.snda.wifilocating

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/base.apk.u6rU68r1.kgs --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/oat/x86/base.apk.u6rU68r1.odex --compiler-filter=quicken --class-loader-context=&com.snda.wifilocating

ioc	pid	process
/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/base.apk.u6rU68r1.kgs	4172	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/base.apk.u6rU68r1.kgs --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/oat/x86/base.apk.u6rU68r1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/base.apk.u6rU68r1.kgs	4035	com.snda.wifilocating

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Reads information about phone network operator.
Removes a system notification. 1 IoCs
evasion

Processes:

com.snda.wifilocating

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.snda.wifilocating
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.snda.wifilocating

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.snda.wifilocating

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.snda.wifilocating

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.snda.wifilocating

com.snda.wifilocating
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4035
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/base.apk.u6rU68r1.kgs --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/oat/x86/base.apk.u6rU68r1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/base.apk.u6rU68r1.kgs

Filesize
2.0MB

MD5
565c12bf2c40c09e61b8204c235f696b

SHA1
293227394c6e264d7f7f4080eca56f636afdf620

SHA256
604dbe535cade6cf5eaa224f91cd42f5d693f3058db17ce3fbcd926461730025

SHA512
4730a613e6bed967760860d6a00741ec307956eea747d22249aec90dceaf7db5fc0dd687b9dd45240a5faa02d60b81735508f063290f072d84346e3fd5959bb5

Download Submit
/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/base.apk.u6rU68r1.kgs

Filesize
2.0MB

MD5
565c12bf2c40c09e61b8204c235f696b

SHA1
293227394c6e264d7f7f4080eca56f636afdf620

SHA256
604dbe535cade6cf5eaa224f91cd42f5d693f3058db17ce3fbcd926461730025

SHA512
4730a613e6bed967760860d6a00741ec307956eea747d22249aec90dceaf7db5fc0dd687b9dd45240a5faa02d60b81735508f063290f072d84346e3fd5959bb5

Download Submit
/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/base.apk.u6rU68r1.kgs.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/fUG76ggg.Fga6

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/oat/x86/base.apk.u6rU68r1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/oat/x86/base.apk.u6rU68r1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/Uf88GFI86G/g8UG6ffyg7Thg7g/tmp-base.apk.u6rU68r1020176013466836040.kgs

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/shared_prefs/DHL.xml

Filesize
133B

MD5
705fde1c6f64cd36b51d19c2f2db7933

SHA1
7765ed2f0c32a4d0ee5212021ac24431252c99cf

SHA256
3dfc3f81607cc4dcb02412884a04c8c8b7ca585ef0e6adb1527e9560576a2c28

SHA512
d91f32eef6ebd5b5020bb9fdb117dccb7dc660a00aa1081eddfae5fc2712dea57fbcc560ec622f12d597c74e9c0f39a5e206fdd8ae22e46e76791393e7b37b28

Download Submit
/data/user/0/com.snda.wifilocating/shared_prefs/DHL.xml

Filesize
176B

MD5
cbe6da69358ca1f9668b9e1666a044e5

SHA1
427198c81849040f0d20ab1a922106fdfabeef25

SHA256
9a78cefd65e3d0dbe8b0769f0094f1e7ff8a34ba75a2b787453fd7b89b79a98d

SHA512
0c9b40280aea4d34d64d8530284776314dbfde49f7ff9ea5f43cf5f1ec156da717f713d9c42630ed3a1d74ae1b77bb0392651e77773caf3ad38f1ac4633f47ae

Download Submit
/data/user/0/com.snda.wifilocating/shared_prefs/DHL.xml

Filesize
240B

MD5
f1043fe98990f2c7bba70995a3c30549

SHA1
2170bdbb09127a2afeb05a304c82105902aa185d

SHA256
795bf08c2356e5a1c8f265a3a0689433ef620583b73b581b6c91f57f92ac396d

SHA512
ac7b40bdd59eab188b8f3b464b6e87596640ccea5b20f2fb6b933547d6f7b5178b116777828c1cf9a3dc7770d133a3de902ec14171eba6d8c440776bf8587df8

Download Submit