flubot | 65669de0e895064949130f60df5fbd94a1f30af3d5c34c8e5a22065e4334f198

Analysis

max time kernel
380996s
max time network
615s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
26-10-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65669de0e895064949130f60df5fbd94a1f30af3d5c34c8e5a22065e4334f198.apk
Size

3.0MB
MD5

8911032f30ee0ecc589bcabfb72c0573
SHA1

72802bd568b2118a7de463a451cb13e20bbd88e7
SHA256

65669de0e895064949130f60df5fbd94a1f30af3d5c34c8e5a22065e4334f198
SHA512

885159589c864b92674ddba1d12516d2b7315d757c79d87bb9179b9ef28eab2a074ac921b866846902ae566250eb55ffebfc55a50af9237ad31b3c55e09c3f59
SSDEEP

49152:g0hCpryDHH0D6gmPOroTV8asMbUCZhSFNw/wgiNcJ3W7HxTQqUonXH3twp:gbrWn0DAOroTV87w4w/b09RzUsGp

Score

10^/10

flubot banker discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/files/4146-0.dat	family_flubot
behavioral1/memory/4146-0.dex	family_flubot
behavioral1/memory/4204-0.dex	family_flubot
behavioral1/memory/4146-1.dex	family_flubot

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.xunmeng.pinduoduo

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.xunmeng.pinduoduo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.xunmeng.pinduoduo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.xunmeng.pinduoduo

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.xunmeng.pinduoduo/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4146	com.xunmeng.pinduoduo
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4204	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4146	com.xunmeng.pinduoduo

Removes a system notification. 1 IoCs

evasion

Processes:

com.xunmeng.pinduoduo

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.xunmeng.pinduoduo

com.xunmeng.pinduoduo
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4146
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
3295dbeea222279d227a2c3cab5d99ca

SHA1
a8cdf90f561932d3c4d731df6bf659229488167b

SHA256
c6c265e23b50e5375c9e67b27da8bb36ada0f10840a2881720ef4f3314abd6f8

SHA512
27a15346ee73a817fcbcf6a80c4c576e91b74d2f0141a11fe11a5be8cd94482e3597a54e0277475b420702ca064d02422bff3adc9d702215a8f59a1d01ffea00

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml

Filesize
133B

MD5
a424c8b4467bc4fd10f281316c3e8786

SHA1
10ebabd91113db5901f16e114a8f09277310d336

SHA256
6a033d6f46cac491129cdd2f499c9239df9ad93c849e4af6ee4159f4879e1d06

SHA512
f356fb07c9227f39a3bbc6fb80d510f4ff6e80183918b17798bd2b942061edd3e2c044e46aa1049127b6bb6f067b100551369e2c4ad1d0cfeb7a4a78bc9f7a69

Download Submit
/data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml

Filesize
197B

MD5
a0f18669ee8eb5fe7451f0aea87f7594

SHA1
d37ce03b6865786669d62de11dde123e51478e96

SHA256
5fcc8d1bf9d09a5bf7a14cb1153ac4f5142082ecda8cf933a97d9284543a0ae8

SHA512
9569adadb3e6712d421df5054356b88f57b4229c89193d1d06f02cfcda805bd64bf117066f8195b433b07f965837be07690d8c36abff4bc610c82c1ac26de8b6

Download Submit