flubot | 2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c

Resubmissions

27/10/2022, 00:09

221027-afm4bsaber10

26/10/2022, 23:41

221026-3px9waaacl10

Analysis

max time kernel
382209s
max time network
156s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
27/10/2022, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eb446a816c77cab326d2fe91fb9b3dd3e5be21e0eb0e4eb35fbdebcdc8d56d35_unpacked.apk
Size 4.0MB
Sample221027-afm4bsaber
SHA256 2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c
MD5 2ffac6c6ba63598b34dc8a076208f7b4
SHA1 02d20c723835a961b594ada5c5acff8ee5ed9bab
SHA512 fbb2955d883d9275bfa0f7c23ca1110ceed1b13083ec249f8445c9c203fdbd9554c36ab91b7c3634871812f3661a7a0b33dc4168b2ef0f1afcff26e370468bd8
SSDEEP 98304:+1iNL19D17KA443+dt+G9ZDPAC77jZRFJhYv09Lc:7NLLZ7l4F2+97j7FJ/Lc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 4 IoCs

resource	yara_rule
behavioral1/files/4042-0.dat	family_flubot
behavioral1/memory/4042-0.dex	family_flubot
behavioral1/memory/4152-0.dex	family_flubot
behavioral1/memory/4042-1.dex	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4042	com.tencent.mm
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4152	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_apkprotector_dex/oat/x86/classes-v1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4042	com.tencent.mm

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4042
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_apkprotector_dex/oat/x86/classes-v1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

classes-v1.bin

Path /data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin
Size 3.1MB
SHA256 45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf
MD5 aca8ab11deeeed62a960d35ffa984401
SHA1 a20fc21166d30e80f0f8cfcd3ce7c7a11b579960
SHA512 c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8
SSDEEP 49152:Q6MaMK62JW094Mnr5C9//H2cMeei1B/KTW7k:QlLK62JW04I8ONi16W4
MD5 SHA1 SHA512 SSDEEP

Submit Download

classes-v1.bin

Path /data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin
Size 3.1MB
SHA256 45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf
MD5 aca8ab11deeeed62a960d35ffa984401
SHA1 a20fc21166d30e80f0f8cfcd3ce7c7a11b579960
SHA512 c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8
SSDEEP 49152:Q6MaMK62JW094Mnr5C9//H2cMeei1B/KTW7k:QlLK62JW04I8ONi16W4
MD5 SHA1 SHA512 SSDEEP

Download

classes-v1.bin

Path /data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin
Size 3.1MB
SHA256 24779aa5e7b19568d23938c0cecb74cce7f08dd7190ff602d788af241409a1b4
MD5 be4a01c50b0abbabbdcbb8b549f43a2a
SHA1 c50a9b8ae100bdf1698852e0e5ac5ed3976c752d
SHA512 baafabf7b1261f0767bf0f87d411e470c758db7a243668ac00f45ae315158a239b07bc24849ad04de62034a5f6da0eeddaf93c1621bb31d2d34047d9cad82274
SSDEEP 24576:QCWgR1fMliafwfuXAXQXUXR1pZdW094MnrxylswgC9/UKHUNuRD1Ma1EqDmwkWgm:Q6MaMK62JW094Mnr5C9//HfReMWk
MD5 SHA1 SHA512 SSDEEP

Download

classes-v1.bin

Path /data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin
Size 3.1MB
SHA256 45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf
MD5 aca8ab11deeeed62a960d35ffa984401
SHA1 a20fc21166d30e80f0f8cfcd3ce7c7a11b579960
SHA512 c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8
SSDEEP 49152:Q6MaMK62JW094Mnr5C9//H2cMeei1B/KTW7k:QlLK62JW04I8ONi16W4
MD5 SHA1 SHA512 SSDEEP

Download

FedEx.xml

Path /data/user/0/com.tencent.mm/shared_prefs/FedEx.xml
Size 133B
SHA256 e9ae0f275a7f585bcd92fa7971cca38ea328e17fe17cef7a6f8ad0b14f69a6fd
MD5 88520d876575333edf5447238a57f963
SHA1 4fb1d21553f7289662ffc8da3e336b0a3bed21f6
SHA512 d3f685c5d630b978ce09b6aa447dc8f6da2216e5665dbf5011c4833c38f8d86181c7559ac1bce5343e40096f8243576b1070a676c9a35e44daccd96e05dc6af2
MD5 SHA1 SHA512

Submit Download

FedEx.xml

Path /data/user/0/com.tencent.mm/shared_prefs/FedEx.xml
Size 197B
SHA256 c809aba75e726919c46a4adb813443a23abc5c5100c82c03ac4f3c0f360b77a5
MD5 07e07f688924d3e98ad2ac532e453b7b
SHA1 97621a6e56fb9bb75fea1c257e8cd22380ffd4b9
SHA512 f404ace2e20b319de282acc37816cfb9cec805459547a0422099bb7755d05858642b8dafd32cd1ca118bf87cba275535961bb5dd5b098d07cf355c752aba7278
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads