flubot | 65669de0e895064949130f60df5fbd94a1f30af3d5c34c8e5a22065e4334f198

Analysis

max time kernel
381008s
max time network
635s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
26-10-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65669de0e895064949130f60df5fbd94a1f30af3d5c34c8e5a22065e4334f198.apk
Size

3.0MB
MD5

8911032f30ee0ecc589bcabfb72c0573
SHA1

72802bd568b2118a7de463a451cb13e20bbd88e7
SHA256

65669de0e895064949130f60df5fbd94a1f30af3d5c34c8e5a22065e4334f198
SHA512

885159589c864b92674ddba1d12516d2b7315d757c79d87bb9179b9ef28eab2a074ac921b866846902ae566250eb55ffebfc55a50af9237ad31b3c55e09c3f59
SSDEEP

49152:g0hCpryDHH0D6gmPOroTV8asMbUCZhSFNw/wgiNcJ3W7HxTQqUonXH3twp:gbrWn0DAOroTV87w4w/b09RzUsGp

Score

10^/10

flubot banker discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 3 IoCs

Processes:

resource	yara_rule
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	family_flubot
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	family_flubot
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.xunmeng.pinduoduo

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.xunmeng.pinduoduo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.xunmeng.pinduoduo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.xunmeng.pinduoduo

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.xunmeng.pinduoduo

ioc	pid	process
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4408	com.xunmeng.pinduoduo
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4408	com.xunmeng.pinduoduo

Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.xunmeng.pinduoduo

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.xunmeng.pinduoduo
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.xunmeng.pinduoduo

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.xunmeng.pinduoduo
Removes a system notification. 1 IoCs
evasion

Processes:

com.xunmeng.pinduoduo

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.xunmeng.pinduoduo

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.xunmeng.pinduoduo

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.xunmeng.pinduoduo

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.xunmeng.pinduoduo

com.xunmeng.pinduoduo
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml

Filesize
133B

MD5
d385d9ddfbf55ab4314ab2a3f209ddcd

SHA1
e376138c159340fe38a7a45c23e8a88a3db497b6

SHA256
53514cf291cf807b37687dd2daef4f04dec302258ac3e7c93f4cbed41bda2c25

SHA512
341d9c2cf3ac27270a4bed2f79563990053b59d74f7f71fb6e5b9b4b55a57782e756494f2908f5cfdbeae19622fee8974f0ee19864a7be1e3882da7b4ea3ad2c

Download Submit
/data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml

Filesize
197B

MD5
a14f470d281f7c3c356df8e3e3ef8130

SHA1
cb1efbbe378a0cc6355a61034e22425f97c4a891

SHA256
8db835676d033d08f3ed3bfb2b06cba4a0ef5dbf7265a3000b97df7b08544aec

SHA512
9de4d644a40f4f2d737aa76c60104e8aa39caf702dd91e999af005489e2dad03c4c756faa96ec2187f20a0f87580a1ea18bd39c1e4214195c900ddd6c1baaf5b

Download Submit