flubot | 8fd1dbdb76379205f545cb4262e36e2b486d52f604367121ec39e112e62d2efa

Analysis

max time kernel
380665s
max time network
29s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
26-10-2022 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fd1dbdb76379205f545cb4262e36e2b486d52f604367121ec39e112e62d2efa.apk
Size

4.5MB
MD5

2b26b4dd18ca1d2f588fc95b2e09fdd9
SHA1

63520604747d2a09104cd0dd20bc8c6e4c42f3a0
SHA256

8fd1dbdb76379205f545cb4262e36e2b486d52f604367121ec39e112e62d2efa
SHA512

e5ce70694416b6540fa4f867a0cc9fd16d28981645fd861e6c9425bc0c221a4e38b20e0e1a9606e073c54ae11fba2f24c7dfb863e51023dc812a93f30f1a062d
SSDEEP

98304:X3h/ZC7gdRZ3JTfKcsiTmze3xc3hZMVxLm0lYVsMJi:h//R3Tf37Me3xc3nGLD6Vsj

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 3 IoCs

Processes:

resource	yara_rule
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	family_flubot
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	family_flubot
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	family_flubot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.bilibili.app.in

ioc	pid	process
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	4492	com.bilibili.app.in
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi	4492	com.bilibili.app.in

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.bilibili.app.in

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.bilibili.app.in

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.bilibili.app.in

com.bilibili.app.in
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi

Filesize
4.7MB

MD5
554c059a775d682f11e77ad941e1f436

SHA1
2ec6a5d1b82289e8d8f7973ac2cd5d479f714890

SHA256
5710732441308f8016698f594b7ae7461b58992846bf25b83070f4addb7881fd

SHA512
51c64948b0e4faf2040d11d62811fe1e47faa1580865b22dde9e13cadc4d260dfa60064e87bfc4dbe6d5921fa8ca64d51bcd000588abfd674ddaa63d0c819c48

Download Submit
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi

Filesize
4.7MB

MD5
554c059a775d682f11e77ad941e1f436

SHA1
2ec6a5d1b82289e8d8f7973ac2cd5d479f714890

SHA256
5710732441308f8016698f594b7ae7461b58992846bf25b83070f4addb7881fd

SHA512
51c64948b0e4faf2040d11d62811fe1e47faa1580865b22dde9e13cadc4d260dfa60064e87bfc4dbe6d5921fa8ca64d51bcd000588abfd674ddaa63d0c819c48

Download Submit
/data/user/0/com.bilibili.app.in/app_apkprotector_dex/Uxc1nLLw.pi

Filesize
4.7MB

MD5
554c059a775d682f11e77ad941e1f436

SHA1
2ec6a5d1b82289e8d8f7973ac2cd5d479f714890

SHA256
5710732441308f8016698f594b7ae7461b58992846bf25b83070f4addb7881fd

SHA512
51c64948b0e4faf2040d11d62811fe1e47faa1580865b22dde9e13cadc4d260dfa60064e87bfc4dbe6d5921fa8ca64d51bcd000588abfd674ddaa63d0c819c48

Download Submit
/data/user/0/com.bilibili.app.in/shared_prefs/Voicemail.xml

Filesize
133B

MD5
58301c4a8d93caec78f8509f6e1bbda4

SHA1
98ee408d137159d4177c71f304a660208501356e

SHA256
bc27487afa066c3016cadfbf61f3b87dc355f00fbcacb9659397ea4f8bb77b7e

SHA512
9f7b729b10b06ba52c43c198fca54eb8550901e14807b17e2636b8ea5ad52e17e3669e18d6c2342636cef8bc36d29b826035db29bc7a06efee43329c9aad6a4f

Download Submit