flubot | 1458b4858ea9983227d68c70d2d9dcdf85c89e66aa9fc50879205d97e08fbbd7

Analysis

max time kernel
1541131s
max time network
156s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
09-11-2022 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1458b4858ea9983227d68c70d2d9dcdf85c89e66aa9fc50879205d97e08fbbd7.apk
Size

5.5MB
MD5

c090102914f9d558dca69c875428946f
SHA1

4887d7a53823bee74d8610f6ba8d0a6163064c33
SHA256

1458b4858ea9983227d68c70d2d9dcdf85c89e66aa9fc50879205d97e08fbbd7
SHA512

1d47e0dd3c8045944cb3a1cf8595f30fd17229f394f0a526d4a7d0f83bdae57c62869cf801a9aa12e5635feea5d3598985101f2e39fdf8e0cf4c051f8683f59b
SSDEEP

98304:lPXp1mY2iKPrYVisH/NhSQUtOejEgFIMKhUC7Q8MK4ShyxrB:NXTmR/YVisFUtdAgS7TMkhyNB

Score

10^/10

flubot banker evasion infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/base.apk.gytqarF1.ue8	family_flubot
/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/base.apk.gytqarF1.ue8	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.qq.reader

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.qq.reader
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.qq.reader
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.qq.reader

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/base.apk.gytqarF1.ue8 --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/oat/x86/base.apk.gytqarF1.odex --compiler-filter=quicken --class-loader-context=&com.qq.reader

ioc	pid	process
/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/base.apk.gytqarF1.ue8	4170	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/base.apk.gytqarF1.ue8 --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/oat/x86/base.apk.gytqarF1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/base.apk.gytqarF1.ue8	4086	com.qq.reader

Reads information about phone network operator.
Removes a system notification. 1 IoCs
evasion

Processes:

com.qq.reader

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.qq.reader
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.qq.reader

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.qq.reader

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.qq.reader

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.qq.reader

com.qq.reader
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4086
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/base.apk.gytqarF1.ue8 --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/oat/x86/base.apk.gytqarF1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4170

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/base.apk.gytqarF1.ue8

Filesize
2.0MB

MD5
f441022e4264c4c77afcce9bc08f8a7c

SHA1
62530755aca4e46db62af5f833e6f724e6b01af8

SHA256
575451955078e1579cd4692a604419cc98801add000ef240439c8caacaf91dc7

SHA512
a9b2c6cd790fa490631da6a97ae6384dbcf9b09302d84f15a033bd4b00bb3be40de25b315bc4b2c3fec0a00fad83ac10ddbcb8194047c61445393f5dd8306209

Download Submit
/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/base.apk.gytqarF1.ue8

Filesize
2.0MB

MD5
f441022e4264c4c77afcce9bc08f8a7c

SHA1
62530755aca4e46db62af5f833e6f724e6b01af8

SHA256
575451955078e1579cd4692a604419cc98801add000ef240439c8caacaf91dc7

SHA512
a9b2c6cd790fa490631da6a97ae6384dbcf9b09302d84f15a033bd4b00bb3be40de25b315bc4b2c3fec0a00fad83ac10ddbcb8194047c61445393f5dd8306209

Download Submit
/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/base.apk.gytqarF1.ue8.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/oat/x86/base.apk.gytqarF1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/oat/x86/base.apk.gytqarF1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/tkyiF6gg.jjue

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qq.reader/Uggjgefggg/yj8tIUrIgd8ggtF/tmp-base.apk.gytqarF5415930764477509797.ue8

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qq.reader/shared_prefs/Flash Player.xml

Filesize
133B

MD5
6dfa5b8a349e96a6e29c3c0b26bd5a9a

SHA1
8852e0d283fcc821019056c38ff4ed40ad954158

SHA256
cc74e280ad7721e4e344f410e67e377648d6dd5d642a74628032ae0d4bbd9eab

SHA512
e55c0faf855e3ca0a7de3f04c217e62e3e5cf32859192a72d7a3f54ed8cbcb087aef2070cc05a4e3a3ac036ecc55e4ec34da2caa234508f9db9fa48329037dba

Download Submit
/data/user/0/com.qq.reader/shared_prefs/Flash Player.xml

Filesize
176B

MD5
6f33950bda1372a4c2eeb14d34c743d6

SHA1
5df6751a224ae8995ca912254d4ca84696759930

SHA256
525c6c2eea75762ecb24b5340795bf761b14047d4a96cc30e97f0e81abce4e3a

SHA512
736f6e28b5a3e98140e970ef728c45287b3a0ed3b8887e461c6d07ce2f85223d1b80acdb52a030bafcb7d8ace80d8c6489054a5e08a428c029d664c8d3593175

Download Submit
/data/user/0/com.qq.reader/shared_prefs/Flash Player.xml

Filesize
240B

MD5
2609f6ff4deb8d3993bd79c0b0005be5

SHA1
3a5a0ac37c556cbd8ef2401e779af7dfa9c957a8

SHA256
9500e7da031515098b5b90f79856291b702950aea8d4f46fdf0f718fa467fda4

SHA512
8c2891cdb9be994342079c8697b77bf35fa5347656666f10dc08cf3161bbed001c1a57d3b0a40f0726389b14b7d80e206b71e5e3a462d1946505fab4295f8728

Download Submit