flubot | 7c92b5617af4da664343684530e88639e0624f21c53a2cadc61a1e6a57fc29d7

Analysis

max time kernel
380720s
max time network
236s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
26-10-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c92b5617af4da664343684530e88639e0624f21c53a2cadc61a1e6a57fc29d7.apk
Size

4.1MB
MD5

3acf9f6b6a813d018d643263766f06b5
SHA1

10bfc1b6b540b56386c335bff1399f20f63eafc9
SHA256

7c92b5617af4da664343684530e88639e0624f21c53a2cadc61a1e6a57fc29d7
SHA512

db814c7c68e3b837954e3f662e1874e7909b1eca3e008ed789c91ecfceaea6f2e403d9388602f5459b043879392bdf03774bb70d6e862515f230ea9bbb8a3f96
SSDEEP

98304:Gw1nfyCcWUCIFy7TEWhMOvKRhMD7h3UXrtQKDEqMn:G2nRVxA0zOOdD7VwrtPIqMn

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 3 IoCs

Processes:

resource	yara_rule
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	family_flubot
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	family_flubot
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	family_flubot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.bilibili.app.in

ioc	pid	process
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	4765	com.bilibili.app.in
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	4765	com.bilibili.app.in

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.bilibili.app.in

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.bilibili.app.in

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.bilibili.app.in

com.bilibili.app.in
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4765

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc

Filesize
4.7MB

MD5
ea3531805c0577d24c0fb6797808e41e

SHA1
db0318d2b6d223fcfbbdeafb6ed62f6a26ffca5f

SHA256
2df449e734c6220d13fc3a9f26db497df413cd593675b6ee51ba95935c8e60b4

SHA512
6f560c00e813b287078300f4a52dc3f076052dceb920021f3ae1dd25d5048064ab956160a870ca732b0475beccd0f18bd536a78f645f23072c43fc3687ccc0ba

Download Submit
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc

Filesize
4.7MB

MD5
ea3531805c0577d24c0fb6797808e41e

SHA1
db0318d2b6d223fcfbbdeafb6ed62f6a26ffca5f

SHA256
2df449e734c6220d13fc3a9f26db497df413cd593675b6ee51ba95935c8e60b4

SHA512
6f560c00e813b287078300f4a52dc3f076052dceb920021f3ae1dd25d5048064ab956160a870ca732b0475beccd0f18bd536a78f645f23072c43fc3687ccc0ba

Download Submit
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc

Filesize
4.7MB

MD5
ea3531805c0577d24c0fb6797808e41e

SHA1
db0318d2b6d223fcfbbdeafb6ed62f6a26ffca5f

SHA256
2df449e734c6220d13fc3a9f26db497df413cd593675b6ee51ba95935c8e60b4

SHA512
6f560c00e813b287078300f4a52dc3f076052dceb920021f3ae1dd25d5048064ab956160a870ca732b0475beccd0f18bd536a78f645f23072c43fc3687ccc0ba

Download Submit
/data/user/0/com.bilibili.app.in/shared_prefs/Voicemail.xml

Filesize
133B

MD5
24fd85dc2177a642b92b754251efeef6

SHA1
3ae576d454ea1f0756eb7e4d3ce5502d076009d9

SHA256
7c62d2335988d078bd0d759f14fa6f1356d585d9b845ff0018f7dc75281ab9f0

SHA512
8ddcb818d84eea0fa2f9db63cfcfd7c82fdfeb620bfd0d53abe370c3dfa48ad4a09610f23b249260c03952c2e8b806b4008d4abd24df2a13bcb84558b6af2e67

Download Submit