flubot | 2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c

Resubmissions

27-10-2022 00:09

221027-afm4bsaber 10

26-10-2022 23:41

221026-3px9waaacl 10

Analysis

max time kernel
382209s
max time network
167s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
27-10-2022 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb446a816c77cab326d2fe91fb9b3dd3e5be21e0eb0e4eb35fbdebcdc8d56d35_unpacked.apk
Size

4.0MB
MD5

2ffac6c6ba63598b34dc8a076208f7b4
SHA1

02d20c723835a961b594ada5c5acff8ee5ed9bab
SHA256

2af548766f9a368e72dfab3c5bf4123da0d52f603e405e801f79a4a9c5b5c07c
SHA512

fbb2955d883d9275bfa0f7c23ca1110ceed1b13083ec249f8445c9c203fdbd9554c36ab91b7c3634871812f3661a7a0b33dc4168b2ef0f1afcff26e370468bd8
SSDEEP

98304:+1iNL19D17KA443+dt+G9ZDPAC77jZRFJhYv09Lc:7NLLZ7l4F2+97j7FJ/Lc

Score

10^/10

flubot banker evasion infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 3 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.tencent.mm

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.tencent.mm

ioc	pid	process
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4591	com.tencent.mm
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin	4591	com.tencent.mm

Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.tencent.mm

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.tencent.mm
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.tencent.mm

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.tencent.mm
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.mm

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.mm

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.tencent.mm

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.tencent.mm

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
PID:4591

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/app_apkprotector_dex/classes-v1.bin

Filesize
3.1MB

MD5
aca8ab11deeeed62a960d35ffa984401

SHA1
a20fc21166d30e80f0f8cfcd3ce7c7a11b579960

SHA256
45b81ea4e359f1a2ccd0a4d537dbbc9fa5839a5c1a81ea26febd3abba5df67cf

SHA512
c0637ee40a12db71c5edfbc51bdb2b5cbb562068047a36cb9e3af9e45087c6b8355ea95c5ffeec6b45fb6cf71dd6a3fd2d5fc046b4b340652adbfb3c2e574cb8

Download Submit
/data/user/0/com.tencent.mm/shared_prefs/FedEx.xml

Filesize
133B

MD5
390d983e30663116994cb7ecf30b1b2b

SHA1
f2eaf0b7fcccc52e9ca7c180455beaaa57855418

SHA256
f2650e083d33ac4b2f50da6c6bd0e69c536577d49102c2883a7265972026e029

SHA512
ca2bd03781dd10477502448f27d899d548ebec3a5bba163fa17d0cd1fb32d0a57829d7ec0a2c6fd159ae817a668de4f6a6014ee99f59015c5c9238a3aab6fdf2

Download Submit
/data/user/0/com.tencent.mm/shared_prefs/FedEx.xml

Filesize
197B

MD5
2e451a2874e08e5bf9e1972998fbef94

SHA1
93582a15b48d3429ec04e9c624ae8655ea0cf01d

SHA256
2069a4cb25577bbb98053fba4b553c67402ac5411b1e50ea65265ae85238d858

SHA512
10e044b807ae0e5c1c0d6a27be242c3bda31fe5dd64fe9405a7d095bfe9fdbc8e18806dfd824564e45900bde94caa72fbd438b4571738d3e65f514438ff8a42b

Download Submit