flubot | 65669de0e895064949130f60df5fbd94a1f30af3d5c34c8e5a22065e4334f198

Analysis

max time kernel
380479s
max time network
104s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
26-10-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65669de0e895064949130f60df5fbd94a1f30af3d5c34c8e5a22065e4334f198.apk
Size

3.0MB
MD5

8911032f30ee0ecc589bcabfb72c0573
SHA1

72802bd568b2118a7de463a451cb13e20bbd88e7
SHA256

65669de0e895064949130f60df5fbd94a1f30af3d5c34c8e5a22065e4334f198
SHA512

885159589c864b92674ddba1d12516d2b7315d757c79d87bb9179b9ef28eab2a074ac921b866846902ae566250eb55ffebfc55a50af9237ad31b3c55e09c3f59
SSDEEP

49152:g0hCpryDHH0D6gmPOroTV8asMbUCZhSFNw/wgiNcJ3W7HxTQqUonXH3twp:gbrWn0DAOroTV87w4w/b09RzUsGp

Score

10^/10

flubot banker infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/files/4902-0.dat	family_flubot
behavioral2/memory/4902-0.dex	family_flubot
behavioral2/memory/4902-1.dex	family_flubot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.xunmeng.pinduoduo

ioc	pid	Process
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4902	com.xunmeng.pinduoduo
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4902	com.xunmeng.pinduoduo

com.xunmeng.pinduoduo
1⤵
- Loads dropped Dex/Jar
PID:4902

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml

Filesize
133B

MD5
882b130866b2dad31d394b78cc17f8c7

SHA1
b46c257fa1c79ce7e6b74a1b58dbff1f832be386

SHA256
42b65b795759642ecf4879851a6137930de0db8ad5673627eb685c2922045aee

SHA512
26c2932082f64c9637c9ae78bd8848d3c9c040ee4f9bd42839d825dd453eec851d72f7fe7f90b6e7d419899ef0a7056a7ce200312670f767865f8e5a714970bd

Download Submit
/data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml

Filesize
197B

MD5
df9933eb49126daa4a74be8da26eca1f

SHA1
0d480121e7bbd9f9506ca15cb7643d7aa025de74

SHA256
b567a4fc7439f3a0ae1ca3707766fbcf9fa2b9b01f11ec45d0554eef52e93649

SHA512
bb5fd0a2ee0e165e87979d2701cd0474af4dd66eda2ac91736410e99654376ea0494276900b8fe8a7b0cdf0e23ccf18ffc814fc0a5a4497e725eab72080b677f

Download Submit