flubot | c22c7b1f473939ebaa1ae8f891065633a767a4ad84b804e1c61faa7d8ad22763

Analysis

max time kernel
381028s
max time network
101s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
26/10/2022, 23:41

Target
c22c7b1f473939ebaa1ae8f891065633a767a4ad84b804e1c61faa7d8ad22763.apk
Size 3.8MB
Sample221026-3pxcksaabr
SHA256 c22c7b1f473939ebaa1ae8f891065633a767a4ad84b804e1c61faa7d8ad22763
MD5 c136b8d59db8d91ec022aa0151028e05
SHA1 9eae5b7351e1cfb35d67a78d441b9c612dce491f
SHA512 34b0c0947f321ba8b785ed36412bbc7a59c77438962afaf0d67179232e36ab7c1d885c9f83e0384900c0c1723249f29cd8fc7548423ff647a01678d349b08fe3
SSDEEP 98304:tNerged/OIfZCj2e2GVoEnyAXaJMTp/fGCpQDM:t4rgtj2+/p93pQDM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

resource	yara_rule
behavioral2/memory/4765-0.dex	family_flubot

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/base.apk.classes1.zip	4765	com.iqiyi.i18n

base.apk.classes1.zip

Path /data/user/0/com.iqiyi.i18n/code_cache/secondary-dexes/base.apk.classes1.zip
Size 2.4MB
SHA256 2a7d1f5b88741377488ac0bf0c22b81573803a7729738c3a7dc081fefcb88c7d
MD5 97dda0e8d28f6defb1950d05e650b4b4
SHA1 9883c2bf6cba5d1b46fcba54baf01342f2adb7a1
SHA512 7b7c75790dc77ac71f3b9bfbfea4bd48cddb03347d6ce33cb1266a3b1af0e9759249c800b57f084353fa6a9ecc41c90149060a0e3cb8136b801cab6743219127
SSDEEP 24576:KiUnEz8fIFRHk5RYWO7fLYhaDCEkiChPKTmh6yV/tmv0Z/9gB:B8fIFRHkHYW/QCwyKTOE
MD5 SHA1 SHA512 SSDEEP

Download

Voicemail.xml

Path /data/user/0/com.iqiyi.i18n/shared_prefs/Voicemail.xml
Size 133B
SHA256 2b15b3db0d7d6bf584db0da7d3942e00fdbab97f4914d89ad3a3ca025c638edf
MD5 3779b90ec03171c54e58addccd8871e3
SHA1 ebde1444eac5e98b29e8b5581cd0f7a6f00d7137
SHA512 43cbbdcf69f97c2ccdd41ffbd76623fcadc1b4a8aaf27a63e5116e7c4e9d990fc3b071d87f65fc7d962e4a2021732306cae817a02e7327be9130236456fb6384
MD5 SHA1 SHA512

Submit Download

Voicemail.xml

Path /data/user/0/com.iqiyi.i18n/shared_prefs/Voicemail.xml
Size 197B
SHA256 df6682973d56512ff1a61d14441998557376030540612ebf3be022aa0da8f9db
MD5 f33a4f593bd6295aac0a9b9d552e658a
SHA1 b65f28714f60bb56868d38b812a3462b6e4ec254
SHA512 87e5a3852ee8411b461e9c69027d5d230ea1e97f48b331244ee3a6b079fba2fa33231e909e9c8329b7f3cb55dbec11222270e62d99ce55054497be38d6efa9e3
MD5 SHA1 SHA512

Submit Download

multidex.version.xml

Path /data/user/0/com.iqiyi.i18n/shared_prefs/multidex.version.xml
Size 307B
SHA256 2cb15641dd8ca4879195bd5385b19733c6fb9882271feb9c0d86d8550b474ec1
MD5 b609c2c5066d2aae8d65d749a7165e17
SHA1 f12e06745c21bd96583c66b734c13a3a6a687ba3
SHA512 42702c0350afd11523f2e36b292c0fbca3da4a446876ad9601c5589c016e84e56a97082d20900eb85719f81f002e4ea305c65908d41772366a3d522ffcd1031c
MD5 SHA1 SHA512

Submit Download