flubot | eb446a816c77cab326d2fe91fb9b3dd3e5be21e0eb0e4eb35fbdebcdc8d56d35

Analysis

max time kernel
381549s
max time network
617s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
26/10/2022, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fedex.apk
Size 4.0MB
Sample221026-3pxy4saack
SHA256 2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c
MD5 2ffac6c6ba63598b34dc8a076208f7b4
SHA1 02d20c723835a961b594ada5c5acff8ee5ed9bab
SHA512 fbb2955d883d9275bfa0f7c23ca1110ceed1b13083ec249f8445c9c203fdbd9554c36ab91b7c3634871812f3661a7a0b33dc4168b2ef0f1afcff26e370468bd8
SSDEEP 98304:+1iNL19D17KA443+dt+G9ZDPAC77jZRFJhYv09Lc:7NLLZ7l4F2+97j7FJ/Lc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

flubot banker discovery evasion infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 3 IoCs

resource	yara_rule
behavioral3/files/4414-0.dat	family_flubot
behavioral3/memory/4414-0.dex	family_flubot
behavioral3/memory/4414-1.dex	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4414	com.tencent.mm
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4414	com.tencent.mm

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.tencent.mm

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.tencent.mm

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
PID:4414

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

classes-v1.bin

Path /data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin
Size 3.1MB
SHA256 45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf
MD5 aca8ab11deeeed62a960d35ffa984401
SHA1 a20fc21166d30e80f0f8cfcd3ce7c7a11b579960
SHA512 c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8
SSDEEP 49152:Q6MaMK62JW094Mnr5C9//H2cMeei1B/KTW7k:QlLK62JW04I8ONi16W4
MD5 SHA1 SHA512 SSDEEP

Submit Download

classes-v1.bin

Path /data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin
Size 3.1MB
SHA256 45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf
MD5 aca8ab11deeeed62a960d35ffa984401
SHA1 a20fc21166d30e80f0f8cfcd3ce7c7a11b579960
SHA512 c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8
SSDEEP 49152:Q6MaMK62JW094Mnr5C9//H2cMeei1B/KTW7k:QlLK62JW04I8ONi16W4
MD5 SHA1 SHA512 SSDEEP

Download

classes-v1.bin

Path /data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin
Size 3.1MB
SHA256 45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf
MD5 aca8ab11deeeed62a960d35ffa984401
SHA1 a20fc21166d30e80f0f8cfcd3ce7c7a11b579960
SHA512 c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8
SSDEEP 49152:Q6MaMK62JW094Mnr5C9//H2cMeei1B/KTW7k:QlLK62JW04I8ONi16W4
MD5 SHA1 SHA512 SSDEEP

Download

FedEx.xml

Path /data/user/0/com.tencent.mm/shared_prefs/FedEx.xml
Size 133B
SHA256 d5561f8152782dac40df0439b725180aa4681b347cb80b7370adda336eb93c29
MD5 c98b864d7fa72884b4adaec6fa1c191e
SHA1 e87064d7dbb5d3aceeb6484a84a38a67b97776d5
SHA512 8a414712a50a7ab236b7d3e02a574ddcf4e6aa343075433956f3cdd26ebb9ae1ef8a604dd1cbed843a40fa6601370160c6ff3a3bb21f7a08215e0ef01759454c
MD5 SHA1 SHA512

Submit Download

FedEx.xml

Path /data/user/0/com.tencent.mm/shared_prefs/FedEx.xml
Size 197B
SHA256 8c789e6e423b6f13627b0e41854c0daaf3c2b7e307d23cc4a53b052ab2c4658b
MD5 97e12bb16280f61dd89b991137677191
SHA1 363fec69e18b9f20842a26d9f0e408b73b0280b6
SHA512 b520d26e0755ba18c21e258a93be3c721d2c02cd96475c3f73bcb81280b7a17abbf1cfba4769cd3e580c3b4549e7e1c82675a544452868cb4c1818fbd6dfa0f2
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads