flubot | 2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c

Analysis

max time kernel
381826s
max time network
612s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
26-10-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c.apk
Size

4.0MB
MD5

2ffac6c6ba63598b34dc8a076208f7b4
SHA1

02d20c723835a961b594ada5c5acff8ee5ed9bab
SHA256

2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c
SHA512

fbb2955d883d9275bfa0f7c23ca1110ceed1b13083ec249f8445c9c203fdbd9554c36ab91b7c3634871812f3661a7a0b33dc4168b2ef0f1afcff26e370468bd8
SSDEEP

98304:+1iNL19D17KA443+dt+G9ZDPAC77jZRFJhYv09Lc:7NLLZ7l4F2+97j7FJ/Lc

Score

10^/10

flubot banker discovery infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 3 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.mm

ioc	pid	process
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4785	com.tencent.mm
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4785	com.tencent.mm

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.mm

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.mm

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4785

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/shared_prefs/FedEx.xml

Filesize
133B

MD5
e9d20f38980daf8917155731ed84d2e4

SHA1
b858623d20ab753792fef59aa651028ae2bda9a0

SHA256
790c4c2711bf0b2a4575d4b761cd9d11feeeedc667699c4160b5e859d7c20bfd

SHA512
4355f95e10d0170d4cc6bc98fc876e55e361abbc6883d4329cda039dced0b1013dcc9664f68e1fbd8533ba75d7b96a3a25830f7ab2a26896d4fdd36b65f68629

Download Submit
/data/user/0/com.tencent.mm/shared_prefs/FedEx.xml

Filesize
197B

MD5
a2a83a0913cc3a4e759506371dd5e042

SHA1
1afd6de2241cd198bdce70d5541190bab1852281

SHA256
4493efe1dcda19d0d638b11e5a61a2c52aed7298787773cf10d58502591759e3

SHA512
456e682cc827c1419465fbc57fd2c9aa85e11708d6739d71377f69c93a5456ff1e4acb769e1ea46a08694652100ca6519fba6b4f1ff6e668de0e37c66e223e60

Download Submit