flubot | 16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19

Analysis

max time kernel
382089s
max time network
611s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
26-10-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19.apk
Size

3.3MB
MD5

7e97532091767c01d5b426c4d0726fff
SHA1

99828b200a44302507ed272c3fad84cc9747924d
SHA256

16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19
SHA512

7994e440985226af7455f58e1f54bd37ad51fd27999d5c8023d240eb966111fb8058e6dcf183aeb8566d648f5f5d6d22d5f76a016649a7e7f7c5a9729792cb64
SSDEEP

98304:+1Yg6KjW5BJcfAWod/ZvrbgMB4HrpolkUOlwz:ES+WPSEd/FrbgMAylAwz

Score

10^/10

flubot banker discovery infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/files/4140-5.dat	family_flubot
behavioral1/memory/4140-2.dex	family_flubot
behavioral1/memory/4303-0.dex	family_flubot
behavioral1/memory/4140-3.dex	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.tencent.westarthk

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.westarthk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.westarthk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.westarthk

Loads dropped Dex/Jar 6 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.westarthk/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/dp.kotlin-v1.lua.mph --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/oat/x86/dp.kotlin-v1.lua.odex --compiler-filter=quicken --class-loader-context=&/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.westarthk/app_ded/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.tencent.westarthk/app_ded/oat/x86/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/dp.kotlin-v1.lua.mph	4140	com.tencent.westarthk
/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/dp.kotlin-v1.lua.mph	4189	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/dp.kotlin-v1.lua.mph --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/oat/x86/dp.kotlin-v1.lua.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/dp.kotlin-v1.lua.mph	4140	com.tencent.westarthk
/data/user/0/com.tencent.westarthk/app_ded/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.dex	4140	com.tencent.westarthk
/data/user/0/com.tencent.westarthk/app_ded/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.dex	4303	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.westarthk/app_ded/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.tencent.westarthk/app_ded/oat/x86/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tencent.westarthk/app_ded/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.dex	4140	com.tencent.westarthk

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

com.tencent.westarthk
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4140
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/dp.kotlin-v1.lua.mph --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/oat/x86/dp.kotlin-v1.lua.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4189
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.westarthk/app_ded/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.tencent.westarthk/app_ded/oat/x86/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4303

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.westarthk/app_ded/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.dex

Filesize
1.5MB

MD5
1be07a7baad9b4a2a0580a8e60629658

SHA1
26253e76f2fa7ea97b9d406281fbd1586a1f0aaa

SHA256
f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334

SHA512
c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.dex

Filesize
1.5MB

MD5
1be07a7baad9b4a2a0580a8e60629658

SHA1
26253e76f2fa7ea97b9d406281fbd1586a1f0aaa

SHA256
f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334

SHA512
c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.dex

Filesize
1.5MB

MD5
1969f6d1e3afc6031732df24dc4fbdb7

SHA1
fdb2632d99062b994ed8caaad784a6024a02aae3

SHA256
1a075847d0cd3121fde2f8be8397f652b058376a49e8fd77236ba57bee4504a9

SHA512
fdca73ca7080f75460ef366c4a529c85ce095c31fa6d9904f8dd97f62798d892b9c2d37d3b38718f6d76cd3bb62e4fe5fcab121efdb66e44e3928c7cab9543a7

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.dex

Filesize
1.5MB

MD5
1be07a7baad9b4a2a0580a8e60629658

SHA1
26253e76f2fa7ea97b9d406281fbd1586a1f0aaa

SHA256
f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334

SHA512
c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.dex.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/oat/x86/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/oat/x86/QSVkCCDPYErOZd3M31QeObg3dZpDbzSq.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/cache/src1663831582500817732

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/dp.kotlin-v1.lua.mph

Filesize
120KB

MD5
c384c5cdaf8f3edfa29389f2de2effea

SHA1
5e5dad9692cf5794e3ff7b99a64e6555399bc56f

SHA256
0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

SHA512
7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

Download Submit
/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/dp.kotlin-v1.lua.mph

Filesize
120KB

MD5
c384c5cdaf8f3edfa29389f2de2effea

SHA1
5e5dad9692cf5794e3ff7b99a64e6555399bc56f

SHA256
0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

SHA512
7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

Download Submit
/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/dp.kotlin-v1.lua.mph

Filesize
120KB

MD5
5e0ca1f47d3a8db8a8124c2cc1764665

SHA1
4b12e946982d6734639b598e1c07de978742d57d

SHA256
82bda6c0b3a3a18143df2b9719f11a455bee95300adb6eec16ec3c0cb210edf9

SHA512
447bcbf794f066e711e7d3f517c04d15ec705e4e1e271d82428abb467c888fb3ee5dc235192087f2df7f57baea974a2feb862671f4eb81605468962ace39712b

Download Submit
/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/dp.kotlin-v1.lua.mph

Filesize
120KB

MD5
c384c5cdaf8f3edfa29389f2de2effea

SHA1
5e5dad9692cf5794e3ff7b99a64e6555399bc56f

SHA256
0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

SHA512
7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

Download Submit
/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/dp.kotlin-v1.lua.mph.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/oat/x86/dp.kotlin-v1.lua.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/cache/src1663831582500817732/oat/x86/dp.kotlin-v1.lua.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/shared_prefs/UPS.xml

Filesize
197B

MD5
245d0e6c3726a5f34cc30aacb83f2444

SHA1
cbe40a9282a54279d55c641aa79ee233a28f40b1

SHA256
121f978b2cf980f5f407ccf71c3c61c7e1adfb6e71aeac6a006c74b7b9f3a121

SHA512
e5b4aea13c75f9e85dee6c4b0a47820f41e5284388e142d496c34537340e775b413ed1c2e9fb71a5acfc862747659671d81ba69d09a2013ebb0f251403790cc9

Download Submit
/data/user/0/com.tencent.westarthk/shared_prefs/UPS.xml

Filesize
133B

MD5
ba9ea6c24f3e8df1386cf4adba93b25e

SHA1
1eaa07084dc866deb27ec11bf41c807d3d7f6444

SHA256
a8e17f0d11334a17240fa71944a8edbcda14c0a48df4e11fb45de4a61f052ad1

SHA512
edda60d5de56b50afe044289083d8f780c344f2f6bfebe292aafe7de496957ab0f3b98314f440f7a8f2dea1e429fec5579d9bb0efc7a28c9e2bb20797cb009b9

Download Submit