flubot | 0140d7fc370864a1c693dc4159cf656f27f89c7349827fdcd5cdc8218278b6f4

Analysis

max time kernel
2453025s
max time network
306s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
27-02-2023 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0140d7fc370864a1c693dc4159cf656f27f89c7349827fdcd5cdc8218278b6f4.apk
Size

3.1MB
MD5

df5cce61f996ffd66a93aa74e43a475f
SHA1

e0ebf372b9c92ee5660a9d8f733b9b353299e5c3
SHA256

0140d7fc370864a1c693dc4159cf656f27f89c7349827fdcd5cdc8218278b6f4
SHA512

3426f36334e49c1c38f47a31f536c7b857f93dbae6036d1fadfdb7efe7b4d42020f4251d3b6874e09ad2348b75a658d0099951f06c56e940f3bb2e81f7b9f510
SSDEEP

49152:RoXoz2acQhxIPZHhBVpKawLhKHAaTYGsXEuIm/MGBozhOhz1+Nw92flvMR5yNIjG:RoC2DQhxIPBXUYg0sX3T/fTXQf1YCoZo

Score

10^/10

flubot banker discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip	family_flubot
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.immomo.momo

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.immomo.momo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.immomo.momo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.immomo.momo

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.immomo.momo/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&com.immomo.momo

ioc	pid	process
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip	4121	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.immomo.momo/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip	4092	com.immomo.momo

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Reads information about phone network operator.
Removes a system notification. 1 IoCs
evasion

Processes:

com.immomo.momo

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.immomo.momo

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.immomo.momo

com.immomo.momo
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4092
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.immomo.momo/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4121

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.immomo.momo/code_cache/secondary-dexes/MultiDex.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
2.4MB

MD5
22afbdb2ad6e8b03ff324006c3552885

SHA1
00c3ebcf4aa0ca01656a0fe4f8d191dfafc907f3

SHA256
0567e8443ef7946115eea6e40d20552bc3b9f36cd8ce03cc2f17e0a32a5bd2d7

SHA512
a90fc798f36464b3034d768794c77c8433fe1a9631eb85e9af4d965d1d5167aa0fbd6b1ed3cb145eab27d2d7c61a2e4dbee8a5d41d0a54c1822baa08184db6b7

Download Submit
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
2.4MB

MD5
cd6f951529d04cd0cb8e5d9fbb1be7fd

SHA1
11a6827f710300463d0e509fb5368130a1d2dbc1

SHA256
132e63b2beb43d09ba55e819af4a9237e4616a50d3d06ae9bc8254aab89dabb5

SHA512
f7e7ac11462e9f3df4992e3c3cf9957d6dcc1bfe6332bbec472100fb70cde9229d51d07341826804d3473396813c8e357dabe95e8f91567f94b637fe3387a856

Download Submit
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/base.apk.classes1.zip.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/oat/x86/base.apk.classes1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.immomo.momo/code_cache/secondary-dexes/tmp-base.apk.classes1608113173625280062.zip

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.immomo.momo/shared_prefs/DHL Express Mobile.xml

Filesize
133B

MD5
93c2744d2f4468ceaeafceb6690d7bb4

SHA1
a4904415f433e7be9c521095938ae491fb9601f8

SHA256
240755e9f1b6deabb147ac63af482e0f96b84134f78520d46b81130d9becaf4c

SHA512
bbf856808487a27f14aabae00e365ddb7c163419414c67f3d8832db6767bc5a3db53529bded6d97d1924bb092d57154c5fdcc405b7ed64c685be657d2b2a530f

Download Submit
/data/user/0/com.immomo.momo/shared_prefs/DHL Express Mobile.xml

Filesize
197B

MD5
f005360ef14d2d8d080145915b629958

SHA1
fbd4fdfb26d0641378fb0de43b884f6dbc619114

SHA256
78e92fde42e5162c302e5b05ccee0d976ae873dd66067841c13071dcae59a9c3

SHA512
de612c0df2e8f940fea90f9b9d19ed67586f7eac1adef88d192bb7d3382fe67b9622938685a0c4a7e9d025c04beffaad5cb3855c659b951b848b81add0b9c38e

Download Submit
/data/user/0/com.immomo.momo/shared_prefs/multidex.version.xml

Filesize
307B

MD5
56d4a8242fee0f8297e494a4706a6052

SHA1
37e6f320095e2d069150f4a3a015cb92cb1dc12c

SHA256
6076db122ba8fe738f01f952d69c4db929192d3540c3245857d090cf489db0be

SHA512
265cc4ce17966457b67554243b6adfd20afde8ae54b74f12237ccc0ef46823c947c43a25fecb08afbae89dd0d95eae351f7228762dcca448a7f43b9d619430dd

Download Submit