flubot | 28c11bb998bf8c023a212c6518b4f8219c8583c2e79fc87d76be6fcad51b522f

Analysis

max time kernel
380960s
max time network
608s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
26-10-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28c11bb998bf8c023a212c6518b4f8219c8583c2e79fc87d76be6fcad51b522f.apk
Size

4.9MB
MD5

92891906b5842b1daac01661731116b9
SHA1

53ff2b0a928fda3439d188c9b7d2f989f7e93eec
SHA256

28c11bb998bf8c023a212c6518b4f8219c8583c2e79fc87d76be6fcad51b522f
SHA512

0b5f95a0c2022953c8ccf65808c976ea54718495952a115d557098443dc7509d419fe2c5255f05795a057061cf64bf69479c349a8361e7f4950325dc7344feb0
SSDEEP

98304:Ctbtx8eId6BxzYR3veFk1lW1zdMQ0pDDDxjUXIklfie3RrQm+jVNryVIh:Cxq8bzYR3WFk1lW1zdMPxDDxI4kXV+xF

Score

10^/10

flubot banker discovery infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4007-0.dex	family_flubot
behavioral1/memory/4107-0.dex	family_flubot
behavioral1/memory/4007-1.dex	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

extend.dress.since

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	extend.dress.since
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	extend.dress.since
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	extend.dress.since

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

extend.dress.since/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/extend.dress.since/app_DynamicOptDex/oat/x86/BeJsupe.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json	4007	extend.dress.since
/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json	4107	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/extend.dress.since/app_DynamicOptDex/oat/x86/BeJsupe.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json	4007	extend.dress.since

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

Processes:

extend.dress.since

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	extend.dress.since

extend.dress.since
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4007
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/extend.dress.since/app_DynamicOptDex/oat/x86/BeJsupe.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4107

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json

Filesize
1.5MB

MD5
e2993d2a3cd519c197e808c18750fd07

SHA1
22d1cc1b7db89f1dfc1892a954778399ac903005

SHA256
7cfd37d111f15e729ad5d9bd8c831771e2157d68808e51ec2470437087636c73

SHA512
7ea089e7169b574e8d8ff524d0f9742f1eee6e901a2dc9fb92d3160b517db46cebe7b4549ab250426560d27227eba57780e0cd3bdae63b3e3dc5070f5ae6ac0f

Download Submit
/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json

Filesize
1.5MB

MD5
40bc23344a0f46f04cf0533ae12c86b4

SHA1
4330aa71cc6bce9eac084368d207f1aeeabbec50

SHA256
e89d9804064dfff2a9890e595825a3074f88ffcbfe7c21800a9464d2aa9ab832

SHA512
e2e32639b3080412ee5a4f898c7ed8f422e854bd8e759402d21eb2620333a60170f80e21998dbe3e2ec652a3c7dc1ff8528c52d5df7a95a35046811b752d4f45

Download Submit
/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json

Filesize
1.5MB

MD5
3e7d7af34d3504f26ca435e0cf106313

SHA1
d369bca4ec601a934969bb69909cd04c7ef526a7

SHA256
5502f89b316171cfa3c79aba4b6729c859e84f328a7f6535ec67fb13b2294b50

SHA512
c6728241a5dba91c843771489ddc6b73619307c467089da1d4317b24852f008f62aa72b31ff3b691af68688cf46eea381517a5ef2907e7e67739bf2c7fa45efb

Download Submit
/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json

Filesize
1.5MB

MD5
40bc23344a0f46f04cf0533ae12c86b4

SHA1
4330aa71cc6bce9eac084368d207f1aeeabbec50

SHA256
e89d9804064dfff2a9890e595825a3074f88ffcbfe7c21800a9464d2aa9ab832

SHA512
e2e32639b3080412ee5a4f898c7ed8f422e854bd8e759402d21eb2620333a60170f80e21998dbe3e2ec652a3c7dc1ff8528c52d5df7a95a35046811b752d4f45

Download Submit
/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/extend.dress.since/app_DynamicOptDex/oat/BeJsupe.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/extend.dress.since/app_DynamicOptDex/oat/x86/BeJsupe.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/extend.dress.since/app_DynamicOptDex/oat/x86/BeJsupe.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/extend.dress.since/shared_prefs/UPS Mobile.xml

Filesize
133B

MD5
50e16d1f2794a49c8126858d5d632268

SHA1
36eaa9c021c31ea7e287baac3b862353d9c95eb9

SHA256
1f19142c59cd4910a349e2b7cad7715eaf2ed113ab729c6e2624afe8ea3772d6

SHA512
3b02b324f6cd5de57b845ac542dfeb25af25fd8dd6fb2fd49fbaffbf128d9ba419ac4ef0354faaaa61dced7e8a0eff7e5047cd1cbeaffaa862be4ec529467226

Download Submit
/data/user/0/extend.dress.since/shared_prefs/UPS Mobile.xml

Filesize
197B

MD5
0a929f0c74d7e3edc1cc564c45c7edf1

SHA1
4c58a3f73a8821547929fa29e16adcf5d520b93a

SHA256
07f120ad809816602acba8dd7d945948a7a57bd8b934f288e56af210f0b5674f

SHA512
d78c3c2c5de29412c1fbf7c3f0d54545090b43184fce8d9c1443edf67240e2b640e555678f958be6bdfdc585bf3cd08c80c85f4657e3590d1e7a52994be66348

Download Submit