flubot | 30937927e8891f8c0fd2c7b6be5fbc5a05011c34a7375e91aad384b82b9e6a67

Analysis

max time kernel
380986s
max time network
616s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
26-10-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30937927e8891f8c0fd2c7b6be5fbc5a05011c34a7375e91aad384b82b9e6a67.apk
Size

6.1MB
MD5

1a2a4044cf18eed59e66c413db766145
SHA1

4e6e9995c3792d8cbcdd8aeb762bb0a6f74cef68
SHA256

30937927e8891f8c0fd2c7b6be5fbc5a05011c34a7375e91aad384b82b9e6a67
SHA512

cc069b2cc2e3c55190b0c840d98b2f6612e7779c759a24dfd903d96a028f5375ef806c40910efb98d566cef276557dab5cba13397cedc9a1ad56c1d2e1727ae8
SSDEEP

98304:piRrQE87MwGC0NnlKaNzvc0j9nj1lA9wVAe0bAQfkFLv0yim:pW87Mznl1XnRlA68qj0yn

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 3 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json	family_flubot
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json	family_flubot
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.tencent.mm

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.mm/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/fBbBL.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json	4146	com.tencent.mm
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json	4252	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/fBbBL.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json	4146	com.tencent.mm

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.mm

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.mm

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4146
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/fBbBL.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json

Filesize
3.1MB

MD5
4d1af208adc4e3b48ae49a8f9bb6a3bf

SHA1
c01efaade18827744ea039b365b1392574cbe11e

SHA256
35f92b7fab00a5dedec023de3bd5f4bc66f317043a62bee3d47c267bc28349b1

SHA512
4ac2b3c9374abbed0a8169f51965711f19461695b905c0221b51883360803521e80f5087209ec134a2b0303f13add277eef3eb8dd2173861c334d7dfde958906

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json

Filesize
3.1MB

MD5
9176c3e392a554fec7890533a61886ab

SHA1
74f83c8167c59c65ad1b508055dfac445bc08c25

SHA256
27ed9910cd1e4f2357df3d687bb8a375b97c1a8655cf0c30a64eff495a9b3b1c

SHA512
ffc4182c020c35d5a44eaf413943115d093ed4640bf9c9fa750c8fd8c6cca8947c1ddce3581b842bdb28588ce7af829dc4e23d1cb7f0b668f5c16c21adb3cbca

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json

Filesize
3.1MB

MD5
e8b100462913641b3b3ff92e25c28952

SHA1
b6f14c00f93608112d45b67cee5b8b981e575785

SHA256
863a1018014257e0c569c7217dccbd5d810f236e2bb9ffaee02a7e9b3b006437

SHA512
7524ee74a85dfa1c8c4488618e73e56d9e24db1bf99bd03fcea053cbe5c5a26340d1acf0a6d7cac0714e794544b1b551265e8db0176c5d5aa497856f28659974

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json

Filesize
3.1MB

MD5
9176c3e392a554fec7890533a61886ab

SHA1
74f83c8167c59c65ad1b508055dfac445bc08c25

SHA256
27ed9910cd1e4f2357df3d687bb8a375b97c1a8655cf0c30a64eff495a9b3b1c

SHA512
ffc4182c020c35d5a44eaf413943115d093ed4640bf9c9fa750c8fd8c6cca8947c1ddce3581b842bdb28588ce7af829dc4e23d1cb7f0b668f5c16c21adb3cbca

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/fBbBL.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/fBbBL.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/fBbBL.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.mm/shared_prefs/FedEx.xml

Filesize
133B

MD5
f0255993fd54a9428c4adf6c1c340242

SHA1
79ab0e34f0fa91ae71d0bc4ff156cef844b5e3dd

SHA256
17e99d263956718a945246690f05e16d27b9a3aa51152105dfa7f3c111b6ab99

SHA512
ffe150e60ab31dbd6b1160060ccf8f4d55f63b4670f091009cf345e0ca4fe17133c67bf7c5697dba9337b5cb592115ee2166483457df2129b29103725a69e458

Download Submit
/data/user/0/com.tencent.mm/shared_prefs/FedEx.xml

Filesize
197B

MD5
4e5e007556f41585ed9bb53dd7b0d463

SHA1
bc464611502ee77a3f4b46aaa7829b6e190238cd

SHA256
9b94b35a0967f0ac7cce2db00fb5ed80bf66db51b962f6e6ba7d6a271ff7c4a1

SHA512
0101c675ac2624e11264b11c7b0a5d9df896cff9afaeb0f40651348f61b8af339edc58ef4ae8978d82837ab3139526941032ce7fa4004220ec58c490e9002c73

Download Submit