flubot | 78d6dc4d6388e1a92a5543b80c038ac66430c7cab3b877eeb0a834bce5cb7c25

Analysis

max time kernel
380461s
max time network
81s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
26-10-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78d6dc4d6388e1a92a5543b80c038ac66430c7cab3b877eeb0a834bce5cb7c25.apk
Size

4.8MB
MD5

23d92d04a25f2bfea3d2f147cd79be8e
SHA1

956308322bd9d64e9258986d9c5f64439a2c23a3
SHA256

78d6dc4d6388e1a92a5543b80c038ac66430c7cab3b877eeb0a834bce5cb7c25
SHA512

3dcd00d0eeed37f3a912922146cc867de568545ac721257d405154fb05628793f8fa13f340ece6c70a4dd982e95ba53a8b5a83dd17e98cc17be156a7839c17b2
SSDEEP

98304:y4zbjHHYuxJ8GfFaqFGYrVPl7ybvuGP3IpwK98g8ovvSWWZiW:yq3Yuxy4LGYRdun3IpwoV5qWWL

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg	family_flubot
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg]	family_flubot

Loads dropped Dex/Jar 6 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.snda.wifilocating

ioc	pid	process
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg	4771	com.snda.wifilocating
/apex/com.android.runtime/javalib/core-libart.jar	4771	com.snda.wifilocating
/apex/com.android.runtime/javalib/core-oj.jar	4771	com.snda.wifilocating
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg]	4771	com.snda.wifilocating
/apex/com.android.conscrypt/javalib/conscrypt.jar	4771	com.snda.wifilocating
/apex/com.android.runtime/javalib/okhttp.jar	4771	com.snda.wifilocating

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

49 api64.ipify.org
58 api64.ipify.org
131 icanhazip.com
132 icanhazip.com
Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.snda.wifilocating

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.snda.wifilocating

flow	ioc
49	api64.ipify.org
58	api64.ipify.org
131	icanhazip.com
132	icanhazip.com

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.snda.wifilocating

com.snda.wifilocating
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4771

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/apex/com.android.conscrypt/javalib/conscrypt.jar

Filesize
421KB

MD5
8345c73b46814e1384ff8462248b23af

SHA1
4d9a4db4c7cf0a19d041d9191cef90df5d186aad

SHA256
32fbfe031ecde2df1f5427303b61eb84492d3edf22d6a133b002a00bba7c1439

SHA512
5895dbad205eb6a72516745f18d1ad49cdfde4eaa197df752447e488fe976f91eba305499bd8b6abc5c9746b90f377b669a583104b20d5d8bc33fd5bf0b23d74

Download Submit
/apex/com.android.runtime/javalib/core-libart.jar

Filesize
3.1MB

MD5
fd1b06e77f97579a960bb5029b46cc33

SHA1
77e58ddaffe93d39d5f112e0fa35efe3afe94ed0

SHA256
a1ab28fa30b33a8cd126b3a17e0efdd822c7e9b3dc12420646bffdffa04fcd85

SHA512
fa33edce8389af3e4af4b15098a3e5cc178b4fbc52f0041dffda1318802fa2f06bf2ce50114a3e7e5004442a53d334b6272ae6e0aa9b5a0c160681ab2b7f98cc

Download Submit
/apex/com.android.runtime/javalib/core-oj.jar

Filesize
4.7MB

MD5
7e343cbc45b618d05182d74bd61826b2

SHA1
02ee96263b3b967e570e8ddb1fa36cb21032b71b

SHA256
324b5af2ec2d78bb57b1552f429af51ac8d65f7fa277217ae8d4371ab14178d1

SHA512
48cbd8a5b246cf9d6ec16558ab12af131439837094c63a64046de384da933593459fb1aec126393bbe3b2b8ca19437f38b68364c9f158023a7b1a35e6901c705

Download Submit
/apex/com.android.runtime/javalib/okhttp.jar

Filesize
396KB

MD5
b93f8047ed660629c2efe0aef2bbe0e4

SHA1
7c63d6781b3f4e3ebecea0eabd707a9ffdbaa774

SHA256
b6c05e60710e14ce7e7d02cfca7230d6251217374e465aaaca845426017ea89b

SHA512
3a150d1227d123454018eeb232131b25d251277edbaa4e53c059499d9febf15eec429e0c419d9aa7bf5de212c86209e97a15560469b6322ec3c404d431b71e0e

Download Submit
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg

Filesize
2.0MB

MD5
88b801e20e638b2477b2afeb558d1f12

SHA1
3899575ed8d71e86a138018551e3517b06b318b6

SHA256
298a2c754226c4c631c718c436be8d352037a85499b754b5a89865b6c40854b6

SHA512
34a5bacb591332049242de85c34aae63f923fe87e4e27de2fb8a92db5a29d5726ade581bb08015ccc8169545484c8a9fc6ccedf104fe581f4b8291d0c8eb10cb

Download Submit
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/tmp-base.apk.8ghjkfs6999598853702320581.geg

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/ugkjGfgr.gruu

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.snda.wifilocating/shared_prefs/DHL.xml

Filesize
133B

MD5
4b5d088c87ac1dbf310839229db4ae01

SHA1
1cb3337b513951989d41c3f87a37fe5d685ae607

SHA256
3ff587cbc6c2d4ae31568f400c89392b395d15c16eb4e258ca18fb54460cd2ff

SHA512
2a6a1b0b7ba7b389190e4585f016ca8afb7052e2c5426c34be93d2f33fbe59d0973c9fca4cc22143dd98f88781be269d6fdd8602335a51aef37072c9e605043d

Download Submit
/data/user/0/com.snda.wifilocating/shared_prefs/DHL.xml

Filesize
197B

MD5
04cad7ae6d3cc3170af9928ece292c0f

SHA1
04cb54bbaeae1413e2624c1a93af45a6a0626fab

SHA256
507dff6df5cb04b1bf37ece497051a400ae0f8f5fb6ea1b36aca4103ccb9d623

SHA512
22a35070748cf73af90631702d1f2eff2b2402d426a297736de98f6048d6101aa23097bf6c505011e658a174961fbbcd240016ead2236306eab669345a245306

Download Submit
/data/user/0/com.snda.wifilocating/shared_prefs/DHL.xml

Filesize
240B

MD5
45960ae57d0c0592667b43125cc45219

SHA1
82296e87c9de3baa418960993ebd8cfd7008ce1b

SHA256
79861f526f661bb995afc612360ec00d92641213ff289a4bf78eee838133d289

SHA512
d95b7d37a189c2a4b4e29d522dfd510367166c94656f2ec8d896c65e0faa981a27d28cacb4c3ddf7dd07a800716b7ac2426a89e7efb1428c3ea09616100414e6

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.snda.wifilocating/g7fHirjfgj/ggghgg8gTgIrjge/base.apk.8ghjkfs1.geg]

Filesize
2.0MB

MD5
88b801e20e638b2477b2afeb558d1f12

SHA1
3899575ed8d71e86a138018551e3517b06b318b6

SHA256
298a2c754226c4c631c718c436be8d352037a85499b754b5a89865b6c40854b6

SHA512
34a5bacb591332049242de85c34aae63f923fe87e4e27de2fb8a92db5a29d5726ade581bb08015ccc8169545484c8a9fc6ccedf104fe581f4b8291d0c8eb10cb

Download Submit