flubot | 2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c

Resubmissions

27-10-2022 00:09

221027-afm4bsaber 10

26-10-2022 23:41

221026-3px9waaacl 10

Analysis

max time kernel
382209s
max time network
156s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
27-10-2022 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb446a816c77cab326d2fe91fb9b3dd3e5be21e0eb0e4eb35fbdebcdc8d56d35_unpacked.apk
Size

4.0MB
MD5

2ffac6c6ba63598b34dc8a076208f7b4
SHA1

02d20c723835a961b594ada5c5acff8ee5ed9bab
SHA256

2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c
SHA512

fbb2955d883d9275bfa0f7c23ca1110ceed1b13083ec249f8445c9c203fdbd9554c36ab91b7c3634871812f3661a7a0b33dc4168b2ef0f1afcff26e370468bd8
SSDEEP

98304:+1iNL19D17KA443+dt+G9ZDPAC77jZRFJhYv09Lc:7NLLZ7l4F2+97j7FJ/Lc

Score

10^/10

flubot banker infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 4 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.tencent.mm

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.mm/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_apkprotector_dex/oat/x86/classes-v1.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4042	com.tencent.mm
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4152	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_apkprotector_dex/oat/x86/classes-v1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4042	com.tencent.mm

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.mm

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.mm

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4042
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_apkprotector_dex/oat/x86/classes-v1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
be4a01c50b0abbabbdcbb8b549f43a2a

SHA1
c50a9b8ae100bdf1698852e0e5ac5ed3976c752d

SHA256
24779aa5e7b19568d23938c0cecb74cce7f08dd7190ff602d788af241409a1b4

SHA512
baafabf7b1261f0767bf0f87d411e470c758db7a243668ac00f45ae315158a239b07bc24849ad04de62034a5f6da0eeddaf93c1621bb31d2d34047d9cad82274

Download Submit
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.mm/app_apkprotector_dex/oat/x86/classes-v1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.mm/app_apkprotector_dex/oat/x86/classes-v1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.mm/shared_prefs/FedEx.xml

Filesize
133B

MD5
88520d876575333edf5447238a57f963

SHA1
4fb1d21553f7289662ffc8da3e336b0a3bed21f6

SHA256
e9ae0f275a7f585bcd92fa7971cca38ea328e17fe17cef7a6f8ad0b14f69a6fd

SHA512
d3f685c5d630b978ce09b6aa447dc8f6da2216e5665dbf5011c4833c38f8d86181c7559ac1bce5343e40096f8243576b1070a676c9a35e44daccd96e05dc6af2

Download Submit
/data/user/0/com.tencent.mm/shared_prefs/FedEx.xml

Filesize
197B

MD5
07e07f688924d3e98ad2ac532e453b7b

SHA1
97621a6e56fb9bb75fea1c257e8cd22380ffd4b9

SHA256
c809aba75e726919c46a4adb813443a23abc5c5100c82c03ac4f3c0f360b77a5

SHA512
f404ace2e20b319de282acc37816cfb9cec805459547a0422099bb7755d05858642b8dafd32cd1ca118bf87cba275535961bb5dd5b098d07cf355c752aba7278

Download Submit