flubot | c22c7b1f473939ebaa1ae8f891065633a767a4ad84b804e1c61faa7d8ad22763

Analysis

max time kernel
381249s
max time network
599s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
26-10-2022 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c22c7b1f473939ebaa1ae8f891065633a767a4ad84b804e1c61faa7d8ad22763.apk
Size

3.8MB
MD5

c136b8d59db8d91ec022aa0151028e05
SHA1

9eae5b7351e1cfb35d67a78d441b9c612dce491f
SHA256

c22c7b1f473939ebaa1ae8f891065633a767a4ad84b804e1c61faa7d8ad22763
SHA512

34b0c0947f321ba8b785ed36412bbc7a59c77438962afaf0d67179232e36ab7c1d885c9f83e0384900c0c1723249f29cd8fc7548423ff647a01678d349b08fe3
SSDEEP

98304:tNerged/OIfZCj2e2GVoEnyAXaJMTp/fGCpQDM:t4rgtj2+/p93pQDM

Score

10^/10

flubot banker discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4149-0.dex	family_flubot
behavioral1/memory/4088-0.dex	family_flubot

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.iqiyi.i18n

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.iqiyi.i18n
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.iqiyi.i18n
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.iqiyi.i18n

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&com.iqiyi.i18n

ioc	pid	Process
/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/base.apk.classes1.zip	4149	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/base.apk.classes1.zip	4088	com.iqiyi.i18n

Removes a system notification. 1 IoCs

evasion

Processes:

com.iqiyi.i18n

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.iqiyi.i18n

com.iqiyi.i18n
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4088
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4149

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/MultiDex.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
2.4MB

MD5
f6553449c8c4056b3bfc7af7446b6dd6

SHA1
a4ddaee2ae4fc73bf852687c5202f1590a1de2f1

SHA256
a353b4c58a85668aa27863115ee18e253896bea085e9632a21fabcc477d2b371

SHA512
cd3fe7a14deb5709c099085fea4c30affd5ea093e3ab04392095b2d19b18a8797109b5420f9fc1d081d78123806f46a2ffca0ae98b04d1b049d7b2b3893cc761

Download Submit
/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
2.4MB

MD5
97dda0e8d28f6defb1950d05e650b4b4

SHA1
9883c2bf6cba5d1b46fcba54baf01342f2adb7a1

SHA256
2a7d1f5b88741377488ac0bf0c22b81573803a7729738c3a7dc081fefcb88c7d

SHA512
7b7c75790dc77ac71f3b9bfbfea4bd48cddb03347d6ce33cb1266a3b1af0e9759249c800b57f084353fa6a9ecc41c90149060a0e3cb8136b801cab6743219127

Download Submit
/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/base.apk.classes1.zip.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/oat/x86/base.apk.classes1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/tmp-base.apk.classes501996646356932432.zip

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.iqiyi.i18n/shared_prefs/Voicemail.xml

Filesize
133B

MD5
7877f09742de78d18c41fcb0124775ed

SHA1
22cb737b27043b69511d647915d5435199b6a9b8

SHA256
85fa1f94cad755d76f896ce5b01986172dccca22eac55e27894b18b5f0b46aa5

SHA512
962510c324a544879306dd7af08accfd7827703030e92637ed4773b9f62c988d04c49982d9152a253e07068fad19114b63cd88940545dd5ad607e62a67cb787d

Download Submit
/data/user/0/com.iqiyi.i18n/shared_prefs/Voicemail.xml

Filesize
197B

MD5
9b97e7ec6f559647d33dea9af1b22f9f

SHA1
47fe4a1dec74efce47ce7e16f0614530075e2e0a

SHA256
0b973ae2bc4eded215d203f144b5b15eeccb4788859986d8580ab5bcbe05943a

SHA512
cc390855ada273195b5a7b918a270cb491e876e8fd6e1275a6e8d4d39846154b2f2d112c24a7beabb1b1f66fb7111a35d70acb43adde9054d6c107010b1b332f

Download Submit
/data/user/0/com.iqiyi.i18n/shared_prefs/multidex.version.xml

Filesize
307B

MD5
3e909e69abc4eb28abd0c7fa9a033891

SHA1
04e7b7e1961b9b37aa1f5a2167240e720e2a4224

SHA256
bad7b67e62da864fdb96321f5f95a86f47f9a13cb2679783a0de1dbd8103e8cd

SHA512
16aeae71d433a6f64614f6a09442f8cb2f1e8abf8331dc934543a1ac59f716563844c8e2072344beb535d414807629644817a69628bbac33bcdff305c3f9501a

Download Submit