flubot | 16427dc764ddd03c890ccafa61121597ef663cba3e3a58fc6904daf644467a7c

Analysis

max time kernel
848251s
max time network
67s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
12-09-2022 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16427dc764ddd03c890ccafa61121597ef663cba3e3a58fc6904daf644467a7c.apk
Size

5.4MB
MD5

098b5ec115662385d761042806d85492
SHA1

a66cf97d9458f7c3b568f801a99f54f9bde14efe
SHA256

16427dc764ddd03c890ccafa61121597ef663cba3e3a58fc6904daf644467a7c
SHA512

898bb420badffdfeba358dd290dba02238b7acf166080b55a8189c76f532865878ccf8fc4f02ae542469eef2d80414f9fbfd2e7fe9280ff1c26c0a875cc8b918
SSDEEP

98304:Bg3vvJeZDDJkZlLbgOQ0vUMO01QfEuhd5YJ7Efhm1dSScc0uDObtPxK:G3HJq3S1Q0MMTyhd5wNbSPcebtU

Score

10^/10

flubot banker infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.mobileqq/dI8Gewhjhf/6jghjGtqgfTgItH/base.apk.8dejHg61.gyg	family_flubot

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.tencent.mobileqq

ioc pid process

/data/user/0/com.tencent.mobileqq/dI8Gewhjhf/6jghjGtqgfTgItH/base.apk.8dejHg61.gyg 4891 com.tencent.mobileqq
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

46 api64.ipify.org
55 api64.ipify.org
59 icanhazip.com
41 icanhazip.com
42 icanhazip.com
43 icanhazip.com
44 icanhazip.com
45 icanhazip.com
Reads information about phone network operator.

ioc	pid	process
/data/user/0/com.tencent.mobileqq/dI8Gewhjhf/6jghjGtqgfTgItH/base.apk.8dejHg61.gyg	4891	com.tencent.mobileqq

flow	ioc
46	api64.ipify.org
55	api64.ipify.org
59	icanhazip.com
41	icanhazip.com
42	icanhazip.com
43	icanhazip.com
44	icanhazip.com
45	icanhazip.com

com.tencent.mobileqq
1⤵
- Loads dropped Dex/Jar
PID:4891

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mobileqq/dI8Gewhjhf/6jghjGtqgfTgItH/base.apk.8dejHg61.gyg

Filesize
2.1MB

MD5
ff4a28a91c63039a7a6ea1ee9f958e70

SHA1
bdaeffce5a25686164d3d2d0469ca2000d8bca3f

SHA256
ea4107eb9315c9ec499485e299519de74b2d5815f96a74603364b3434e576109

SHA512
77eae92b130a9e4b78de3082237e22a1a5e1d8f390b2f29e273a6771942e722d5e0fd6566144814727846c83e97f7df6caf93b7c17382507e7c875e7c4399de3

Download Submit
/data/user/0/com.tencent.mobileqq/dI8Gewhjhf/6jghjGtqgfTgItH/tmp-base.apk.8dejHg67425437648631261316.gyg

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.mobileqq/dI8Gewhjhf/6jghjGtqgfTgItH/yIugjhgG.jq6I

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.mobileqq/shared_prefs/Voicemail.xml

Filesize
133B

MD5
38f1ccd742c687ca2c39a64000114bdc

SHA1
69cdb5b77d137e0bcb794b45a3cbbcff2de71095

SHA256
e07775aa02e21724962f9c504d5710dbed757c051cf28d4564430b0404512d2b

SHA512
35fb0cea919139869ae72d9a68a07bc4e75bd1fc3099b4a51807ae2b9bc6d4b6586bcb63f506e688a160cf50a4aa0685a2ef331d7644b330e5d6cd1fb5b40fd2

Download Submit
/data/user/0/com.tencent.mobileqq/shared_prefs/Voicemail.xml

Filesize
176B

MD5
eb5cf642cb7c7d6c206373cc8190fea0

SHA1
1db0bfd378e0fc2f77c570fa42e18dc086d61828

SHA256
820cd6239c35a3c5f52347cc044e5dc7904bfb2fb284b5c279c10c1b35116377

SHA512
530a269e5f3f01da7ef358abdb69150b1d5f5355eb624ac823a22a513ef7ac4f4b0237d041adaf9ea09c58fb76d8a2734752234e868c86e62dd9b64792fb8857

Download Submit