flubot | eb446a816c77cab326d2fe91fb9b3dd3e5be21e0eb0e4eb35fbdebcdc8d56d35

Analysis

max time kernel
381549s
max time network
617s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
26-10-2022 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fedex.apk
Size

4.0MB
MD5

2ffac6c6ba63598b34dc8a076208f7b4
SHA1

02d20c723835a961b594ada5c5acff8ee5ed9bab
SHA256

2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c
SHA512

fbb2955d883d9275bfa0f7c23ca1110ceed1b13083ec249f8445c9c203fdbd9554c36ab91b7c3634871812f3661a7a0b33dc4168b2ef0f1afcff26e370468bd8
SSDEEP

98304:+1iNL19D17KA443+dt+G9ZDPAC77jZRFJhYv09Lc:7NLLZ7l4F2+97j7FJ/Lc

Score

10^/10

flubot banker discovery evasion infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 3 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.tencent.mm

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.mm

ioc	pid	process
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4414	com.tencent.mm
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4414	com.tencent.mm

Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.tencent.mm

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.tencent.mm
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.tencent.mm

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.tencent.mm
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.mm

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.mm

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.tencent.mm

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.tencent.mm

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
PID:4414

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/shared_prefs/FedEx.xml

Filesize
133B

MD5
c98b864d7fa72884b4adaec6fa1c191e

SHA1
e87064d7dbb5d3aceeb6484a84a38a67b97776d5

SHA256
d5561f8152782dac40df0439b725180aa4681b347cb80b7370adda336eb93c29

SHA512
8a414712a50a7ab236b7d3e02a574ddcf4e6aa343075433956f3cdd26ebb9ae1ef8a604dd1cbed843a40fa6601370160c6ff3a3bb21f7a08215e0ef01759454c

Download Submit
/data/user/0/com.tencent.mm/shared_prefs/FedEx.xml

Filesize
197B

MD5
97e12bb16280f61dd89b991137677191

SHA1
363fec69e18b9f20842a26d9f0e408b73b0280b6

SHA256
8c789e6e423b6f13627b0e41854c0daaf3c2b7e307d23cc4a53b052ab2c4658b

SHA512
b520d26e0755ba18c21e258a93be3c721d2c02cd96475c3f73bcb81280b7a17abbf1cfba4769cd3e580c3b4549e7e1c82675a544452868cb4c1818fbd6dfa0f2

Download Submit