flubot | 7c92b5617af4da664343684530e88639e0624f21c53a2cadc61a1e6a57fc29d7

Analysis

max time kernel
380524s
max time network
35s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
26-10-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c92b5617af4da664343684530e88639e0624f21c53a2cadc61a1e6a57fc29d7.apk
Size

4.1MB
MD5

3acf9f6b6a813d018d643263766f06b5
SHA1

10bfc1b6b540b56386c335bff1399f20f63eafc9
SHA256

7c92b5617af4da664343684530e88639e0624f21c53a2cadc61a1e6a57fc29d7
SHA512

db814c7c68e3b837954e3f662e1874e7909b1eca3e008ed789c91ecfceaea6f2e403d9388602f5459b043879392bdf03774bb70d6e862515f230ea9bbb8a3f96
SSDEEP

98304:Gw1nfyCcWUCIFy7TEWhMOvKRhMD7h3UXrtQKDEqMn:G2nRVxA0zOOdD7VwrtPIqMn

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 4 IoCs

Processes:

resource	yara_rule
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	family_flubot
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	family_flubot
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	family_flubot
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	family_flubot

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.bilibili.app.in

ioc	pid	process
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	4524	com.bilibili.app.in
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	4524	com.bilibili.app.in
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc	4524	com.bilibili.app.in

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.bilibili.app.in

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.bilibili.app.in

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.bilibili.app.in

com.bilibili.app.in
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc

Filesize
4.7MB

MD5
ea3531805c0577d24c0fb6797808e41e

SHA1
db0318d2b6d223fcfbbdeafb6ed62f6a26ffca5f

SHA256
2df449e734c6220d13fc3a9f26db497df413cd593675b6ee51ba95935c8e60b4

SHA512
6f560c00e813b287078300f4a52dc3f076052dceb920021f3ae1dd25d5048064ab956160a870ca732b0475beccd0f18bd536a78f645f23072c43fc3687ccc0ba

Download Submit
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc

Filesize
4.7MB

MD5
ea3531805c0577d24c0fb6797808e41e

SHA1
db0318d2b6d223fcfbbdeafb6ed62f6a26ffca5f

SHA256
2df449e734c6220d13fc3a9f26db497df413cd593675b6ee51ba95935c8e60b4

SHA512
6f560c00e813b287078300f4a52dc3f076052dceb920021f3ae1dd25d5048064ab956160a870ca732b0475beccd0f18bd536a78f645f23072c43fc3687ccc0ba

Download Submit
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc

Filesize
4.7MB

MD5
ea3531805c0577d24c0fb6797808e41e

SHA1
db0318d2b6d223fcfbbdeafb6ed62f6a26ffca5f

SHA256
2df449e734c6220d13fc3a9f26db497df413cd593675b6ee51ba95935c8e60b4

SHA512
6f560c00e813b287078300f4a52dc3f076052dceb920021f3ae1dd25d5048064ab956160a870ca732b0475beccd0f18bd536a78f645f23072c43fc3687ccc0ba

Download Submit
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/98jrUhjf.doc

Filesize
4.7MB

MD5
ea3531805c0577d24c0fb6797808e41e

SHA1
db0318d2b6d223fcfbbdeafb6ed62f6a26ffca5f

SHA256
2df449e734c6220d13fc3a9f26db497df413cd593675b6ee51ba95935c8e60b4

SHA512
6f560c00e813b287078300f4a52dc3f076052dceb920021f3ae1dd25d5048064ab956160a870ca732b0475beccd0f18bd536a78f645f23072c43fc3687ccc0ba

Download Submit
/data/user/0/com.bilibili.app.in/shared_prefs/Voicemail.xml

Filesize
133B

MD5
fa16f162a1267a4bd60de4cee12481b4

SHA1
0b0375b921a62f6874ab72f86ca4ae9c1a4dcbaa

SHA256
d3c278cf6f51a41baf5fdb53e072d40ba8b95e58ff399217c3e480ca6364f394

SHA512
5388bc3c1f6cf1400583e27694b3fcaea41dc411c20ff53906c5665e7967a87eb5fb61d8fa21361593686fd4899feebca1b2d1b34fc8c45816674d0619a01c2a

Download Submit