flubot | 0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23

Resubmissions

07-02-2023 12:04

230207-n8lymaef8v 10

07-02-2023 12:03

230207-n71emaef71 10

Analysis

max time kernel
730761s
max time network
159s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
07-02-2023 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware.unknown.apk
Size

3.0MB
MD5

75c0eb2c78ff31534a588ec47088b622
SHA1

abc703f6e5b824d0a1c14108228009001509a162
SHA256

0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23
SHA512

d0b74f972f851fc7a1f715e152e6f439a080b4d7b1f3129cec6c3164d8b1f75c34a920c393d5d05be45185a2b926b6c382b5e83387436b7905b2500e3db4c36b
SSDEEP

49152:Y09ypryDHH0D6gmPOroTV8asMbUCNhSBNwj0ciNcJ3W7HxTQqUonX73lwp:YXrWn0DAOroTV87w4kjD09RzUsyp

Score

10^/10

flubot banker discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 4 IoCs

Processes:

resource	yara_rule
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	family_flubot
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	family_flubot
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	family_flubot
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.xunmeng.pinduoduo

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.xunmeng.pinduoduo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.xunmeng.pinduoduo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.xunmeng.pinduoduo

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.xunmeng.pinduoduo/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4115	com.xunmeng.pinduoduo
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4172	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4115	com.xunmeng.pinduoduo

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Removes a system notification. 1 IoCs
evasion

Processes:

com.xunmeng.pinduoduo

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.xunmeng.pinduoduo

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.xunmeng.pinduoduo

com.xunmeng.pinduoduo
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4115
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/oat/x86/xCSswjlO.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
3295dbeea222279d227a2c3cab5d99ca

SHA1
a8cdf90f561932d3c4d731df6bf659229488167b

SHA256
c6c265e23b50e5375c9e67b27da8bb36ada0f10840a2881720ef4f3314abd6f8

SHA512
27a15346ee73a817fcbcf6a80c4c576e91b74d2f0141a11fe11a5be8cd94482e3597a54e0277475b420702ca064d02422bff3adc9d702215a8f59a1d01ffea00

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml

Filesize
133B

MD5
bf29ea1bb1537965b21b511cba4bb9a4

SHA1
d959721db05bfd092d656b7c4e51827673c0f5a4

SHA256
6fc602fc9004a4612db9d14e56e1891c35426ba2571c6913bcedef3f35708efb

SHA512
92be10009d9b4f86c23c81f4df0983166eb35e8df4d84106107de842146f0b4a6bc8758a0c66cd0d3dbf33807841d0535b71912350a24e713891ed84c37caa56

Download Submit
/data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml

Filesize
197B

MD5
f592a3e486a227179cd42d16d203cf58

SHA1
6210c33304c8ddaf8832a8e7fbaccc4ef6d987c8

SHA256
ca10bdd4ef62947dcabe9a148265785312af218403b16da40b19f53a3a339a4c

SHA512
ee9897c170ac361e53885172737934562f1f61b0a107592dc9879bebb576751a17732ee91d17415e92fc4f318070de7d1c011c669ea81cddb34fd62662f92169

Download Submit