flubot | 16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19

Analysis

max time kernel
381557s
max time network
86s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
26-10-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19.apk
Size

3.3MB
MD5

7e97532091767c01d5b426c4d0726fff
SHA1

99828b200a44302507ed272c3fad84cc9747924d
SHA256

16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19
SHA512

7994e440985226af7455f58e1f54bd37ad51fd27999d5c8023d240eb966111fb8058e6dcf183aeb8566d648f5f5d6d22d5f76a016649a7e7f7c5a9729792cb64
SSDEEP

98304:+1Yg6KjW5BJcfAWod/ZvrbgMB4HrpolkUOlwz:ES+WPSEd/FrbgMAylAwz

Score

10^/10

flubot banker infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/files/4847-2.dat	family_flubot
behavioral2/memory/4847-2.dex	family_flubot
behavioral2/memory/4847-3.dex	family_flubot

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.westarthk

ioc	pid	Process
/data/user/0/com.tencent.westarthk/cache/src617809242483296714/dp.kotlin-v1.lua.mph	4847	com.tencent.westarthk
/data/user/0/com.tencent.westarthk/cache/src617809242483296714/dp.kotlin-v1.lua.mph	4847	com.tencent.westarthk
/data/user/0/com.tencent.westarthk/app_ded/4Eefv21iYpGjEqolXnOpvRWi8k349Ebo.dex	4847	com.tencent.westarthk
/data/user/0/com.tencent.westarthk/app_ded/4Eefv21iYpGjEqolXnOpvRWi8k349Ebo.dex	4847	com.tencent.westarthk

com.tencent.westarthk
1⤵
- Loads dropped Dex/Jar
PID:4847

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.westarthk/app_ded/4Eefv21iYpGjEqolXnOpvRWi8k349Ebo.dex

Filesize
1.5MB

MD5
1be07a7baad9b4a2a0580a8e60629658

SHA1
26253e76f2fa7ea97b9d406281fbd1586a1f0aaa

SHA256
f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334

SHA512
c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/4Eefv21iYpGjEqolXnOpvRWi8k349Ebo.dex

Filesize
1.5MB

MD5
1be07a7baad9b4a2a0580a8e60629658

SHA1
26253e76f2fa7ea97b9d406281fbd1586a1f0aaa

SHA256
f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334

SHA512
c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/4Eefv21iYpGjEqolXnOpvRWi8k349Ebo.dex

Filesize
1.5MB

MD5
1be07a7baad9b4a2a0580a8e60629658

SHA1
26253e76f2fa7ea97b9d406281fbd1586a1f0aaa

SHA256
f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334

SHA512
c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4

Download Submit
/data/user/0/com.tencent.westarthk/cache/src617809242483296714

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/cache/src617809242483296714/dp.kotlin-v1.lua.mph

Filesize
120KB

MD5
c384c5cdaf8f3edfa29389f2de2effea

SHA1
5e5dad9692cf5794e3ff7b99a64e6555399bc56f

SHA256
0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

SHA512
7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

Download Submit
/data/user/0/com.tencent.westarthk/cache/src617809242483296714/dp.kotlin-v1.lua.mph

Filesize
120KB

MD5
c384c5cdaf8f3edfa29389f2de2effea

SHA1
5e5dad9692cf5794e3ff7b99a64e6555399bc56f

SHA256
0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

SHA512
7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

Download Submit
/data/user/0/com.tencent.westarthk/cache/src617809242483296714/dp.kotlin-v1.lua.mph

Filesize
120KB

MD5
c384c5cdaf8f3edfa29389f2de2effea

SHA1
5e5dad9692cf5794e3ff7b99a64e6555399bc56f

SHA256
0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

SHA512
7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

Download Submit
/data/user/0/com.tencent.westarthk/shared_prefs/UPS.xml

Filesize
133B

MD5
6f905e7bca0da778c7ba0c248f654983

SHA1
7841aadc26f44a5d1c867e3a246fafd840dcb8c3

SHA256
9d065e4f76aebd67b38f22639b5572431ebff64befc283c692eae9556c8d11c7

SHA512
1eb679391a516287db2e343e88dbc35b1d04e34d879da3d793ab1bb8ea87916ada758020a9e217dfc5eace61ed05cd0d32fbda67daf7748a771320457254edd5

Download Submit
/data/user/0/com.tencent.westarthk/shared_prefs/UPS.xml

Filesize
197B

MD5
5bc9f359fa0d1bd26f22d3f51743152b

SHA1
dfeda3311b74c86ee38d8e2c250d5c61a1a41f52

SHA256
51fdf45f95187333834bf340648138a9ae2c57737f26538a970efd6ec50fa454

SHA512
3d246b29cd7eaaf265ef05c9c998f00ee68ca6450b810e6c2d3981e9e1c018b5d9827d99c7363ef14b42bb34d2b493be91a0fc32ee7d469bde91402a7a543659

Download Submit