flubot | 16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19

Analysis

max time kernel
382091s
max time network
615s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
26-10-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19.apk
Size

3.3MB
MD5

7e97532091767c01d5b426c4d0726fff
SHA1

99828b200a44302507ed272c3fad84cc9747924d
SHA256

16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19
SHA512

7994e440985226af7455f58e1f54bd37ad51fd27999d5c8023d240eb966111fb8058e6dcf183aeb8566d648f5f5d6d22d5f76a016649a7e7f7c5a9729792cb64
SSDEEP

98304:+1Yg6KjW5BJcfAWod/ZvrbgMB4HrpolkUOlwz:ES+WPSEd/FrbgMAylAwz

Score

10^/10

flubot banker discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 3 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.westarthk/app_ded/v1wCl3IFV64YAqJj3UbMMZ2aEP74sMpB.dex	family_flubot
/data/user/0/com.tencent.westarthk/app_ded/v1wCl3IFV64YAqJj3UbMMZ2aEP74sMpB.dex	family_flubot
/data/user/0/com.tencent.westarthk/app_ded/v1wCl3IFV64YAqJj3UbMMZ2aEP74sMpB.dex	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.tencent.westarthk

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.westarthk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.westarthk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.westarthk

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.westarthk

ioc	pid	process
/data/user/0/com.tencent.westarthk/cache/src5908997013211773682/dp.kotlin-v1.lua.mph	4640	com.tencent.westarthk
/data/user/0/com.tencent.westarthk/cache/src5908997013211773682/dp.kotlin-v1.lua.mph	4640	com.tencent.westarthk
/data/user/0/com.tencent.westarthk/app_ded/v1wCl3IFV64YAqJj3UbMMZ2aEP74sMpB.dex	4640	com.tencent.westarthk
/data/user/0/com.tencent.westarthk/app_ded/v1wCl3IFV64YAqJj3UbMMZ2aEP74sMpB.dex	4640	com.tencent.westarthk

Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.tencent.westarthk

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.tencent.westarthk
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.tencent.westarthk

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.tencent.westarthk

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.tencent.westarthk

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.tencent.westarthk

com.tencent.westarthk
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.westarthk/app_ded/v1wCl3IFV64YAqJj3UbMMZ2aEP74sMpB.dex

Filesize
1.5MB

MD5
1be07a7baad9b4a2a0580a8e60629658

SHA1
26253e76f2fa7ea97b9d406281fbd1586a1f0aaa

SHA256
f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334

SHA512
c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/v1wCl3IFV64YAqJj3UbMMZ2aEP74sMpB.dex

Filesize
1.5MB

MD5
1be07a7baad9b4a2a0580a8e60629658

SHA1
26253e76f2fa7ea97b9d406281fbd1586a1f0aaa

SHA256
f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334

SHA512
c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4

Download Submit
/data/user/0/com.tencent.westarthk/app_ded/v1wCl3IFV64YAqJj3UbMMZ2aEP74sMpB.dex

Filesize
1.5MB

MD5
1be07a7baad9b4a2a0580a8e60629658

SHA1
26253e76f2fa7ea97b9d406281fbd1586a1f0aaa

SHA256
f426adb0fc20f0ac992c3a0a5fc65bd20720aa5fe266da997c6623161c94f334

SHA512
c2d37b91ec1bd63ee6e5a1b3c3095d041067e6b22b643dcc24ed6853789cfd956c339e224ae7d401664792b0c6669cd5fa806d7707f78d6e502d56a5dade61a4

Download Submit
/data/user/0/com.tencent.westarthk/cache/src5908997013211773682

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.westarthk/cache/src5908997013211773682/dp.kotlin-v1.lua.mph

Filesize
120KB

MD5
c384c5cdaf8f3edfa29389f2de2effea

SHA1
5e5dad9692cf5794e3ff7b99a64e6555399bc56f

SHA256
0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

SHA512
7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

Download Submit
/data/user/0/com.tencent.westarthk/cache/src5908997013211773682/dp.kotlin-v1.lua.mph

Filesize
120KB

MD5
c384c5cdaf8f3edfa29389f2de2effea

SHA1
5e5dad9692cf5794e3ff7b99a64e6555399bc56f

SHA256
0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

SHA512
7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

Download Submit
/data/user/0/com.tencent.westarthk/cache/src5908997013211773682/dp.kotlin-v1.lua.mph

Filesize
120KB

MD5
c384c5cdaf8f3edfa29389f2de2effea

SHA1
5e5dad9692cf5794e3ff7b99a64e6555399bc56f

SHA256
0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

SHA512
7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

Download Submit
/data/user/0/com.tencent.westarthk/shared_prefs/UPS.xml

Filesize
133B

MD5
1bf9dbe3ed0d7e57f3cd4790160a4d59

SHA1
b86608c7d94d7143830d666757a22c8b33b9bf55

SHA256
54dbacbfbbd1d1556298ebc9f217a3c8c27b7e663fdade7650c25712726dccd2

SHA512
7460f52da1a7ddca5b96a81c0e57fb177f0c07d0ccb7f31a0c759defb646e6fff53b583da69da95c2d4bc05a0da0268f7454a5727cdcaa5b2be90a4501e7157f

Download Submit
/data/user/0/com.tencent.westarthk/shared_prefs/UPS.xml

Filesize
197B

MD5
5d7220fd3ce4306eceac140ee795c02e

SHA1
139e6a781faa71516d1beff69c9885f1619915a6

SHA256
7e1ff53be5e63b8af1c34638730c3c828601582e5fc9f70b22dca2aca4c6e063

SHA512
3c1e78022b39ee334e39b22581f3166c9d244d2fe3a6486c2f40587bf66f18f24bee90d82aa9621349885015517f25bd6ae579981a619f29017b12ae404c5f7e

Download Submit