flubot | 0140d7fc370864a1c693dc4159cf656f27f89c7349827fdcd5cdc8218278b6f4

Analysis

max time kernel
2456629s
max time network
311s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
27-02-2023 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0140d7fc370864a1c693dc4159cf656f27f89c7349827fdcd5cdc8218278b6f4.apk
Size

3.1MB
MD5

df5cce61f996ffd66a93aa74e43a475f
SHA1

e0ebf372b9c92ee5660a9d8f733b9b353299e5c3
SHA256

0140d7fc370864a1c693dc4159cf656f27f89c7349827fdcd5cdc8218278b6f4
SHA512

3426f36334e49c1c38f47a31f536c7b857f93dbae6036d1fadfdb7efe7b4d42020f4251d3b6874e09ad2348b75a658d0099951f06c56e940f3bb2e81f7b9f510
SSDEEP

49152:RoXoz2acQhxIPZHhBVpKawLhKHAaTYGsXEuIm/MGBozhOhz1+Nw92flvMR5yNIjG:RoC2DQhxIPBXUYg0sX3T/fTXQf1YCoZo

Score

10^/10

flubot banker infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip	family_flubot

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.immomo.momo

ioc pid process

/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip 4720 com.immomo.momo

ioc	pid	process
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip	4720	com.immomo.momo

com.immomo.momo
1⤵
- Loads dropped Dex/Jar
PID:4720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.immomo.momo/code_cache/secondary-dexes/MultiDex.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
2.4MB

MD5
cd6f951529d04cd0cb8e5d9fbb1be7fd

SHA1
11a6827f710300463d0e509fb5368130a1d2dbc1

SHA256
132e63b2beb43d09ba55e819af4a9237e4616a50d3d06ae9bc8254aab89dabb5

SHA512
f7e7ac11462e9f3df4992e3c3cf9957d6dcc1bfe6332bbec472100fb70cde9229d51d07341826804d3473396813c8e357dabe95e8f91567f94b637fe3387a856

Download Submit
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/tmp-base.apk.classes8307694674378403322.zip

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.immomo.momo/shared_prefs/DHL Express Mobile.xml

Filesize
133B

MD5
c71b7099e062246dfac22a1b6966afb3

SHA1
6f93932bdec9d503c72fe3958b0ac53482f7c969

SHA256
5d0d603b3798b2dd5a7ff788d75af25f6f729152ecc8577817aa3a39676bba97

SHA512
04f55e2d4059f3410f9414f00dbf9fc13659e3824ce1717927eadce7eb1b7d502489f924d2901af16808c670d5c9cfc99e177c89544130061068a4ba8bc2661a

Download Submit
/data/user/0/com.immomo.momo/shared_prefs/DHL Express Mobile.xml

Filesize
197B

MD5
5d71405bfd7d78ee151332b2b75c62f0

SHA1
d6de7dc95d6d9aa5d1de82a777b43c7f20eca6df

SHA256
af95b323c62ec21463254d5f9f2bee6453994740789d77ceadb0178ddaf2bfa7

SHA512
4f1e81746538babdfbd71225f6db8b4af52c217c299be62548b5bbac175747042acbbfc5902963392429d74e4d6bc4bd19015e65a87fc2ceb25f8062679a8e99

Download Submit
/data/user/0/com.immomo.momo/shared_prefs/multidex.version.xml

Filesize
307B

MD5
2f71e22c05e43ec32312082a761c4a8f

SHA1
3f09bcecb03e7c31bb56d6b402d3b9950616dbbf

SHA256
80532393ee22d344f8c2302e83b5de82c99900af89186ea4f4268f170e0f3b2b

SHA512
534e630476801afe8a04a70298aeafbd00c1fd6caec1a80458be29259d8953d2c6943465c491381b2e90c7bd00878b61fe51d932d074566178d82cf6d175e274

Download Submit