flubot | 78d6dc4d6388e1a92a5543b80c038ac66430c7cab3b877eeb0a834bce5cb7c25

Analysis

max time kernel
381077s
max time network
608s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
26-10-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78d6dc4d6388e1a92a5543b80c038ac66430c7cab3b877eeb0a834bce5cb7c25.apk
Size

4.8MB
MD5

23d92d04a25f2bfea3d2f147cd79be8e
SHA1

956308322bd9d64e9258986d9c5f64439a2c23a3
SHA256

78d6dc4d6388e1a92a5543b80c038ac66430c7cab3b877eeb0a834bce5cb7c25
SHA512

3dcd00d0eeed37f3a912922146cc867de568545ac721257d405154fb05628793f8fa13f340ece6c70a4dd982e95ba53a8b5a83dd17e98cc17be156a7839c17b2
SSDEEP

98304:y4zbjHHYuxJ8GfFaqFGYrVPl7ybvuGP3IpwK98g8ovvSWWZiW:yq3Yuxy4LGYRdun3IpwoV5qWWL

Score

10^/10

flubot banker discovery evasion infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg	family_flubot
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg	family_flubot

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.snda.wifilocating

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.snda.wifilocating
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.snda.wifilocating
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.snda.wifilocating

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/oat/x86/base.apk.8ghjkfs1.odex --compiler-filter=quicken --class-loader-context=&com.snda.wifilocating

ioc	pid	process
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg	4107	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/oat/x86/base.apk.8ghjkfs1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg	3992	com.snda.wifilocating

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

43 icanhazip.com
44 icanhazip.com
45 ipinfo.io
46 ipinfo.io
Reads information about phone network operator.
Removes a system notification. 1 IoCs
evasion

Processes:

com.snda.wifilocating

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.snda.wifilocating
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.snda.wifilocating

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.snda.wifilocating

flow	ioc
43	icanhazip.com
44	icanhazip.com
45	ipinfo.io
46	ipinfo.io

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.snda.wifilocating

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.snda.wifilocating

com.snda.wifilocating
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:3992
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/oat/x86/base.apk.8ghjkfs1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4107

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg

Filesize
2.0MB

MD5
88b801e20e638b2477b2afeb558d1f12

SHA1
3899575ed8d71e86a138018551e3517b06b318b6

SHA256
298a2c754226c4c631c718c436be8d352037a85499b754b5a89865b6c40854b6

SHA512
34a5bacb591332049242de85c34aae63f923fe87e4e27de2fb8a92db5a29d5726ade581bb08015ccc8169545484c8a9fc6ccedf104fe581f4b8291d0c8eb10cb

Download Submit
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg

Filesize
2.0MB

MD5
88b801e20e638b2477b2afeb558d1f12

SHA1
3899575ed8d71e86a138018551e3517b06b318b6

SHA256
298a2c754226c4c631c718c436be8d352037a85499b754b5a89865b6c40854b6

SHA512
34a5bacb591332049242de85c34aae63f923fe87e4e27de2fb8a92db5a29d5726ade581bb08015ccc8169545484c8a9fc6ccedf104fe581f4b8291d0c8eb10cb

Download Submit
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/oat/x86/base.apk.8ghjkfs1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/oat/x86/base.apk.8ghjkfs1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/tmp-base.apk.8ghjkfs4889640121854287642.geg

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/ugkjGfgr.gruu

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/shared_prefs/DHL.xml

Filesize
133B

MD5
777f2f0b97f61bcbf91eb35d7fdf3f1a

SHA1
4f8ee81ff9fd65689a92e96f6a182395bb5e3584

SHA256
051f74a23d4dddcb4d06edcb3c35460dddc42be5e31fc9b49ed02ed7178979b0

SHA512
313386cf1a5b3810a48b577a5baa42607f67445c84aaf09a32372309b38a4c7ea4e197d2e1c22863844995f84c7ef51ece2f8c80b5b120fe4ea6068ccf5544a8

Download Submit
/data/user/0/com.snda.wifilocating/shared_prefs/DHL.xml

Filesize
176B

MD5
15bbb3ab9f4d47dba852a4ce6159a95e

SHA1
a94b03ed7e6ff818f622f9dc73db85c311468033

SHA256
8950f42ca9256d1340b647df33b48c1d4b1f2437fddbde475e27682666a49712

SHA512
d771db02b3021166c0aab051c87ed75834e5fb396d0cfe51e501936db91934363d67115a584ec44e2e9b5d675acea6e2eb2b00ec83c3cdd79903e32c68d80462

Download Submit
/data/user/0/com.snda.wifilocating/shared_prefs/DHL.xml

Filesize
240B

MD5
65b7ea50b601bdb8b93c302cf0bd9792

SHA1
47ab90a215ff11beedb97b32dd155dd82c18cf9b

SHA256
c5a9c32ccc593d5540678adaec2fc1d4a36ea9ef0df7e609a1af8e7dd4898829

SHA512
6b49692207be96c82ca49b07d7148ec41ae2a6b7dd36fa52d3a1040611c00ee1edfe926e56d3633317e436f60c1a1022870d18d30772249d6a4ec8a0ba7bc41a

Download Submit