flubot | 0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23

Resubmissions

07-02-2023 12:04

230207-n8lymaef8v 10

07-02-2023 12:03

230207-n71emaef71 10

Analysis

max time kernel
730726s
max time network
160s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
07-02-2023 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware.unknown.apk
Size

3.0MB
MD5

75c0eb2c78ff31534a588ec47088b622
SHA1

abc703f6e5b824d0a1c14108228009001509a162
SHA256

0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23
SHA512

d0b74f972f851fc7a1f715e152e6f439a080b4d7b1f3129cec6c3164d8b1f75c34a920c393d5d05be45185a2b926b6c382b5e83387436b7905b2500e3db4c36b
SSDEEP

49152:Y09ypryDHH0D6gmPOroTV8asMbUCNhSBNwj0ciNcJ3W7HxTQqUonX73lwp:YXrWn0DAOroTV87w4kjD09RzUsyp

Score

10^/10

flubot banker discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 4 IoCs

Processes:

resource	yara_rule
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	family_flubot
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	family_flubot
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	family_flubot
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.xunmeng.pinduoduo

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.xunmeng.pinduoduo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.xunmeng.pinduoduo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.xunmeng.pinduoduo

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.xunmeng.pinduoduo/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4091	com.xunmeng.pinduoduo
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4188	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4091	com.xunmeng.pinduoduo

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Removes a system notification. 1 IoCs
evasion

Processes:

com.xunmeng.pinduoduo

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.xunmeng.pinduoduo

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.xunmeng.pinduoduo

com.xunmeng.pinduoduo
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4091
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
3295dbeea222279d227a2c3cab5d99ca

SHA1
a8cdf90f561932d3c4d731df6bf659229488167b

SHA256
c6c265e23b50e5375c9e67b27da8bb36ada0f10840a2881720ef4f3314abd6f8

SHA512
27a15346ee73a817fcbcf6a80c4c576e91b74d2f0141a11fe11a5be8cd94482e3597a54e0277475b420702ca064d02422bff3adc9d702215a8f59a1d01ffea00

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml

Filesize
133B

MD5
6be93124d0bd6fffcce983551960b7f2

SHA1
7e222416d619164fbe9aa7c03a6de81c7dc85df4

SHA256
12f793c0c885587385b545ab8b0f3efb567136e44ad5ae48091dc876665e3867

SHA512
7c3a976413d9519ceca6203f223246979e4cb58e87abd86f45681af9e7902a6e1147ff802c7c380e74d49870ef1085242480161520dae678a297a4c44413bc49

Download Submit
/data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml

Filesize
197B

MD5
37a57ce576aecc60dc2f76b578d96af7

SHA1
ffce99bcdaac07bdf0cb34be32c04c47143a86cd

SHA256
3cb91462d3182e3f51caf4f4081404cd004e2ba6fb69a711ffd58ac5066c62c8

SHA512
4bdab11785b02d487505a863cd7098efd94c01b7773ddc789f7fd956793df6acbdb39c650424107da61ecb276ec226909036bc1a383660bc7d609d359daa5eaf

Download Submit