flubot | 2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c

Resubmissions

27-10-2022 00:09

221027-afm4bsaber 10

26-10-2022 23:41

221026-3px9waaacl 10

Analysis

max time kernel
381344s
max time network
621s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
26-10-2022 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb446a816c77cab326d2fe91fb9b3dd3e5be21e0eb0e4eb35fbdebcdc8d56d35_unpacked.apk
Size

4.0MB
MD5

2ffac6c6ba63598b34dc8a076208f7b4
SHA1

02d20c723835a961b594ada5c5acff8ee5ed9bab
SHA256

2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c
SHA512

fbb2955d883d9275bfa0f7c23ca1110ceed1b13083ec249f8445c9c203fdbd9554c36ab91b7c3634871812f3661a7a0b33dc4168b2ef0f1afcff26e370468bd8
SSDEEP

98304:+1iNL19D17KA443+dt+G9ZDPAC77jZRFJhYv09Lc:7NLLZ7l4F2+97j7FJ/Lc

Score

10^/10

flubot banker discovery infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 3 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.mm

ioc	pid	process
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4747	com.tencent.mm
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4747	com.tencent.mm

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.mm

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.mm

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4747

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/shared_prefs/FedEx.xml

Filesize
133B

MD5
f65b2525b9fbb42ffd94df3f2c7a47bc

SHA1
a06d4e88f6dc9d06cd26c4766ba67ee589e8a441

SHA256
21bebaa95f4d793984fd0d5a0f1dc5c449cce8476c4dd7b1cafaa5e485761186

SHA512
7a91ab6fc3808a1db12d42a5d5149a56cf9227670c2ac8cca5d8a770bd15d578db45b75a2082414e042e5539a46b8f28cee2b80fe0e1971b7c9785c9cd774c64

Download Submit
/data/user/0/com.tencent.mm/shared_prefs/FedEx.xml

Filesize
197B

MD5
1c51452ef98998ff16338eda87c7af64

SHA1
916c4692e8c3467597906185cea89ea141add0d3

SHA256
8f068f8d6b5e0ff9389a3c0a406f4f4e4d87c3a010ebc33c143c5f0f916455f8

SHA512
fcb2eb659d857736bdb9d57399a96790bb15e78109906b4fecddb1c83aa321feb8785cb7aab6c62a986f024c92d99213143a1a9c47904b59d08ba1470ebba2b9

Download Submit