flubot | 30937927e8891f8c0fd2c7b6be5fbc5a05011c34a7375e91aad384b82b9e6a67

Analysis

max time kernel
380898s
max time network
630s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
26-10-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30937927e8891f8c0fd2c7b6be5fbc5a05011c34a7375e91aad384b82b9e6a67.apk
Size

6.1MB
MD5

1a2a4044cf18eed59e66c413db766145
SHA1

4e6e9995c3792d8cbcdd8aeb762bb0a6f74cef68
SHA256

30937927e8891f8c0fd2c7b6be5fbc5a05011c34a7375e91aad384b82b9e6a67
SHA512

cc069b2cc2e3c55190b0c840d98b2f6612e7779c759a24dfd903d96a028f5375ef806c40910efb98d566cef276557dab5cba13397cedc9a1ad56c1d2e1727ae8
SSDEEP

98304:piRrQE87MwGC0NnlKaNzvc0j9nj1lA9wVAe0bAQfkFLv0yim:pW87Mznl1XnRlA68qj0yn

Score

10^/10

flubot banker discovery infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4982-0.dex	family_flubot
behavioral2/memory/4982-1.dex	family_flubot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.mm

ioc	pid	Process
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json	4982	com.tencent.mm
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json	4982	com.tencent.mm

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

Processes:

com.tencent.mm

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4982

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json

Filesize
3.1MB

MD5
4d1af208adc4e3b48ae49a8f9bb6a3bf

SHA1
c01efaade18827744ea039b365b1392574cbe11e

SHA256
35f92b7fab00a5dedec023de3bd5f4bc66f317043a62bee3d47c267bc28349b1

SHA512
4ac2b3c9374abbed0a8169f51965711f19461695b905c0221b51883360803521e80f5087209ec134a2b0303f13add277eef3eb8dd2173861c334d7dfde958906

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json

Filesize
3.1MB

MD5
9176c3e392a554fec7890533a61886ab

SHA1
74f83c8167c59c65ad1b508055dfac445bc08c25

SHA256
27ed9910cd1e4f2357df3d687bb8a375b97c1a8655cf0c30a64eff495a9b3b1c

SHA512
ffc4182c020c35d5a44eaf413943115d093ed4640bf9c9fa750c8fd8c6cca8947c1ddce3581b842bdb28588ce7af829dc4e23d1cb7f0b668f5c16c21adb3cbca

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/fBbBL.json

Filesize
3.1MB

MD5
9176c3e392a554fec7890533a61886ab

SHA1
74f83c8167c59c65ad1b508055dfac445bc08c25

SHA256
27ed9910cd1e4f2357df3d687bb8a375b97c1a8655cf0c30a64eff495a9b3b1c

SHA512
ffc4182c020c35d5a44eaf413943115d093ed4640bf9c9fa750c8fd8c6cca8947c1ddce3581b842bdb28588ce7af829dc4e23d1cb7f0b668f5c16c21adb3cbca

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/fBbBL.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.mm/shared_prefs/FedEx.xml

Filesize
133B

MD5
20c6caf8889408cb5f924ffa841f6147

SHA1
71f454179d9856eaf3b7f50411c97aa6e638ea2a

SHA256
c612db6f20e0eec3e3d75e0d4df95961bfddbaaa3f495e7af1d61d0349cdf600

SHA512
ff3575876cf48fca22ddf590c2bb1fbce2fb339fbeb73f888b1f99e125a022e87439cdc1bbd9b3973d196f441851782519a4d9ebf1038eca1f7801222241deed

Download Submit
/data/user/0/com.tencent.mm/shared_prefs/FedEx.xml

Filesize
197B

MD5
44668f9df692abc63ad038141df5f267

SHA1
ba5c878c830ecbbab43a95638fc3de3d9f679ced

SHA256
0d3c16bf173542be908ba511c4b2e4dc867b51a88404a2e2a3a254e746862eb4

SHA512
07fb8ae3c6143a7059950c2b2a9b100733baa42b225fe87c4c22aa8f3d7255ec85b1450c57bf4cefd7badf57f67500f42acefb59bd273ea023c603544310c9f6

Download Submit