flubot | 0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23

Resubmissions

07-02-2023 12:04

230207-n8lymaef8v 10

07-02-2023 12:03

230207-n71emaef71 10

Analysis

max time kernel
734360s
max time network
161s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
07-02-2023 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware.unknown.apk
Size

3.0MB
MD5

75c0eb2c78ff31534a588ec47088b622
SHA1

abc703f6e5b824d0a1c14108228009001509a162
SHA256

0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23
SHA512

d0b74f972f851fc7a1f715e152e6f439a080b4d7b1f3129cec6c3164d8b1f75c34a920c393d5d05be45185a2b926b6c382b5e83387436b7905b2500e3db4c36b
SSDEEP

49152:Y09ypryDHH0D6gmPOroTV8asMbUCNhSBNwj0ciNcJ3W7HxTQqUonX73lwp:YXrWn0DAOroTV87w4kjD09RzUsyp

Score

10^/10

flubot banker infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 3 IoCs

Processes:

resource	yara_rule
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	family_flubot
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	family_flubot
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	family_flubot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.xunmeng.pinduoduo

ioc	pid	process
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4728	com.xunmeng.pinduoduo
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king	4728	com.xunmeng.pinduoduo

com.xunmeng.pinduoduo
1⤵
- Loads dropped Dex/Jar
PID:4728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/app_apkprotector_dex/xCSswjlO.king

Filesize
2.4MB

MD5
5b49441a9350dd3b4dba093b8faa2c8e

SHA1
bbe36075bd706b87eb7f96fc498c83088b717226

SHA256
c23491993bd680fa89ca42a5ff0695365e07c83874e4db29b96234d8a21fe10d

SHA512
e4ce7f58ed24644094dee157d4e364c9bd4d68507bac760c760695dc2280052914bfeeb2c020f53b4e9e5da75e173bba28fd994176a4cea66d79a0e648279f94

Download Submit
/data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml

Filesize
133B

MD5
f92d268d55532a2e633af4a43911045d

SHA1
8fa26ba7c7e889a526460a6ea0b2274ab36528b5

SHA256
e9da2b58e64386655d6553674ac19fde4544dc7d5e5077b924a670ae7a11fcb2

SHA512
4e7a172e501d74313146132408cdf15dbf34318b26ecc5c96da7d33cdaedc953330c019aeb97c1a70c952aa8d61f2cef96bb7ae1f59d85155e75b5091a15ab61

Download Submit
/data/user/0/com.xunmeng.pinduoduo/shared_prefs/Voicemail.xml

Filesize
197B

MD5
60e4538e82f897bfbed11746837e70d8

SHA1
de146d60592602f80c769a688c045ec47e4135c1

SHA256
9680cad618f3149dd7c11f024b002c10e14ed7a572684da7118bb93b66a9d10a

SHA512
60c7680b36167b28952181e17e1e0c1c41c41457b40db50f25616dc7059c2acbc871fca41114c97007c90b7b9798785c2a2fcd8f0bab0de090793fff00cd1b4a

Download Submit