flubot | 0140d7fc370864a1c693dc4159cf656f27f89c7349827fdcd5cdc8218278b6f4

Analysis

max time kernel
2456633s
max time network
319s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
27-02-2023 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0140d7fc370864a1c693dc4159cf656f27f89c7349827fdcd5cdc8218278b6f4.apk
Size

3.1MB
MD5

df5cce61f996ffd66a93aa74e43a475f
SHA1

e0ebf372b9c92ee5660a9d8f733b9b353299e5c3
SHA256

0140d7fc370864a1c693dc4159cf656f27f89c7349827fdcd5cdc8218278b6f4
SHA512

3426f36334e49c1c38f47a31f536c7b857f93dbae6036d1fadfdb7efe7b4d42020f4251d3b6874e09ad2348b75a658d0099951f06c56e940f3bb2e81f7b9f510
SSDEEP

49152:RoXoz2acQhxIPZHhBVpKawLhKHAaTYGsXEuIm/MGBozhOhz1+Nw92flvMR5yNIjG:RoC2DQhxIPBXUYg0sX3T/fTXQf1YCoZo

Score

10^/10

flubot banker discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.immomo.momo

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.immomo.momo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.immomo.momo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.immomo.momo

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.immomo.momo

ioc pid process

/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip 4425 com.immomo.momo
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Reads information about phone network operator.
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.immomo.momo

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.immomo.momo
Removes a system notification. 1 IoCs
evasion

Processes:

com.immomo.momo

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.immomo.momo

ioc	pid	process
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip	4425	com.immomo.momo

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.immomo.momo

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.immomo.momo

com.immomo.momo
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4425

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.immomo.momo/code_cache/secondary-dexes/MultiDex.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
2.4MB

MD5
cd6f951529d04cd0cb8e5d9fbb1be7fd

SHA1
11a6827f710300463d0e509fb5368130a1d2dbc1

SHA256
132e63b2beb43d09ba55e819af4a9237e4616a50d3d06ae9bc8254aab89dabb5

SHA512
f7e7ac11462e9f3df4992e3c3cf9957d6dcc1bfe6332bbec472100fb70cde9229d51d07341826804d3473396813c8e357dabe95e8f91567f94b637fe3387a856

Download Submit
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/tmp-base.apk.classes8578702037878717313.zip

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.immomo.momo/shared_prefs/DHL Express Mobile.xml

Filesize
133B

MD5
75e19fa5e7d20810af253eec6682df21

SHA1
f23726e8609879b35f7af75f5548c02383cda00a

SHA256
8fb25b6ef04c541e13364312179f312c66f9a39908ce915d3fe185e4309c155e

SHA512
8af432ebc075e901215f068f0ff8df8d10dc232a441b679261fe37e208339154420938bdceb8bee6197c02c3282da520aa4ecb7c878fa48980412276d550bfac

Download Submit
/data/user/0/com.immomo.momo/shared_prefs/DHL Express Mobile.xml

Filesize
197B

MD5
cf8a3bcd66ae7699b71b817b84eeef5d

SHA1
daf05bc7b4d42640dd6f8e8c0a8dca50ce6c0076

SHA256
b31ad33d52de1aa19edd383a09a7037d530007194555cdac320cdf04c81b69d8

SHA512
c8134ed6fcbebd6516b54814af611841f7470857cae69692f87fa2f07b7ee17bd107cb676d1c504a63203cda30858fe14fe963965b6dfa591492a0dc8cc9d91c

Download Submit
/data/user/0/com.immomo.momo/shared_prefs/multidex.version.xml

Filesize
307B

MD5
5c4d38e14a1525af471b81d722f2b462

SHA1
2ca645a83bb40c97d9e7fe5b05ca7d1ccf65dbdb

SHA256
ddebf5bee281fb8a772a9cc382a3d3c6b710d8bf933d532a35e4e5a79a0411d2

SHA512
052b56f2a331fa54b93383a99648ad118d5d114822e41ea5a484406f42b88c539e0a04de4be80249e2d027ff4204ca4ee92f60fe4e99346cc3db4aad5a0ac003

Download Submit