flubot | 8fd1dbdb76379205f545cb4262e36e2b486d52f604367121ec39e112e62d2efa

Analysis

max time kernel
381131s
max time network
372s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
26/10/2022, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fd1dbdb76379205f545cb4262e36e2b486d52f604367121ec39e112e62d2efa.apk
Size 4.5MB
Sample221026-3pwfaaaabp
SHA256 8fd1dbdb76379205f545cb4262e36e2b486d52f604367121ec39e112e62d2efa
MD5 2b26b4dd18ca1d2f588fc95b2e09fdd9
SHA1 63520604747d2a09104cd0dd20bc8c6e4c42f3a0
SHA512 e5ce70694416b6540fa4f867a0cc9fd16d28981645fd861e6c9425bc0c221a4e38b20e0e1a9606e073c54ae11fba2f24c7dfb863e51023dc812a93f30f1a062d
SSDEEP 98304:X3h/ZC7gdRZ3JTfKcsiTmze3xc3hZMVxLm0lYVsMJi:h//R3Tf37Me3xc3nGLD6Vsj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 4 IoCs

resource	yara_rule
behavioral1/files/4096-0.dat	family_flubot
behavioral1/memory/4096-0.dex	family_flubot
behavioral1/memory/4216-0.dex	family_flubot
behavioral1/memory/4096-1.dex	family_flubot

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	4096	com.bilibili.app.in
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	4216	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.bilibili.app.in/app_apkprotector_dex/oat/x86/Uxc1nLLw.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	4096	com.bilibili.app.in

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.bilibili.app.in

com.bilibili.app.in
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4096
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.bilibili.app.in/app_apkprotector_dex/oat/x86/Uxc1nLLw.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Uxc1nLLw.pi

Path /data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi
Size 4.7MB
SHA256 5710732441308f8016698f594b7ae7461b58992846bf25b83070f4addb7881fd
MD5 554c059a775d682f11e77ad941e1f436
SHA1 2ec6a5d1b82289e8d8f7973ac2cd5d479f714890
SHA512 51c64948b0e4faf2040d11d62811fe1e47faa1580865b22dde9e13cadc4d260dfa60064e87bfc4dbe6d5921fa8ca64d51bcd000588abfd674ddaa63d0c819c48
SSDEEP 24576:jjcGcP0bOoqKeSYqIavYiM0hg5eKOQfIXIn9SsaaARW3gP+MZMH112fSvQUiAe2B:LObjFO4/ld
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uxc1nLLw.pi

Path /data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi
Size 4.7MB
SHA256 5710732441308f8016698f594b7ae7461b58992846bf25b83070f4addb7881fd
MD5 554c059a775d682f11e77ad941e1f436
SHA1 2ec6a5d1b82289e8d8f7973ac2cd5d479f714890
SHA512 51c64948b0e4faf2040d11d62811fe1e47faa1580865b22dde9e13cadc4d260dfa60064e87bfc4dbe6d5921fa8ca64d51bcd000588abfd674ddaa63d0c819c48
SSDEEP 24576:jjcGcP0bOoqKeSYqIavYiM0hg5eKOQfIXIn9SsaaARW3gP+MZMH112fSvQUiAe2B:LObjFO4/ld
MD5 SHA1 SHA512 SSDEEP

Download

Uxc1nLLw.pi

Path /data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi
Size 4.7MB
SHA256 5710732441308f8016698f594b7ae7461b58992846bf25b83070f4addb7881fd
MD5 554c059a775d682f11e77ad941e1f436
SHA1 2ec6a5d1b82289e8d8f7973ac2cd5d479f714890
SHA512 51c64948b0e4faf2040d11d62811fe1e47faa1580865b22dde9e13cadc4d260dfa60064e87bfc4dbe6d5921fa8ca64d51bcd000588abfd674ddaa63d0c819c48
SSDEEP 24576:jjcGcP0bOoqKeSYqIavYiM0hg5eKOQfIXIn9SsaaARW3gP+MZMH112fSvQUiAe2B:LObjFO4/ld
MD5 SHA1 SHA512 SSDEEP

Download

Uxc1nLLw.pi

Path /data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi
Size 4.7MB
SHA256 5710732441308f8016698f594b7ae7461b58992846bf25b83070f4addb7881fd
MD5 554c059a775d682f11e77ad941e1f436
SHA1 2ec6a5d1b82289e8d8f7973ac2cd5d479f714890
SHA512 51c64948b0e4faf2040d11d62811fe1e47faa1580865b22dde9e13cadc4d260dfa60064e87bfc4dbe6d5921fa8ca64d51bcd000588abfd674ddaa63d0c819c48
SSDEEP 24576:jjcGcP0bOoqKeSYqIavYiM0hg5eKOQfIXIn9SsaaARW3gP+MZMH112fSvQUiAe2B:LObjFO4/ld
MD5 SHA1 SHA512 SSDEEP

Download

Voicemail.xml

Path /data/user/0/com.bilibili.app.in/shared_prefs/Voicemail.xml
Size 133B
SHA256 e3e7ae736dabdbd9f4c747353b76656f832dfbf9fd9c8194abcb61f1826960f5
MD5 ce0e9b81775091490db9bf8de3a37efc
SHA1 d7c7fa22de7d41578737a15f515765b12808e369
SHA512 f51c997d7fb2c2e2463417273416f100f2bc2a932863e52bb0b25bb821e110f897ce0c466c3dac2c7fc9b2498fd07fae5dff63a40ccbf5c1157653e1f5f2a3f8
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads