flubot | d2c5e4af486a01426f5c98f8ffb13f69f1defece0e07f2c7e4f39d8c2593829b

Analysis

max time kernel
1858163s
max time network
163s
platform
android_x86
resource
android-x86-arm-20230621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
submitted
19-07-2023 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2c5e4af486a01426f5c98f8ffb13f69f1defece0e07f2c7e4f39d8c2593829b.apk
Size

5.6MB
MD5

95fb562c7721bc502223e9a0b9e5b0f6
SHA1

6ed60847eefb78b9a91d8e0433dc5ea3494357f0
SHA256

d2c5e4af486a01426f5c98f8ffb13f69f1defece0e07f2c7e4f39d8c2593829b
SHA512

a59d5e5840378df2610f599f1529835ec0dc9fd9e74fbaae167152d16dc9b0e01a2d46c99d722e7c88f02ff8fbfed4c25caa3e51fd101e28bd940d0ce6117f15
SSDEEP

98304:Q6NZwHRVLnc20uge7A1PVTf4uFwEEp/txdrroaMtiXIFvGxQdyxrk:Q6fwHRBncHudM9VTfRFwEGRiyKGWdyNk

Score

10^/10

flubot banker evasion infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/base.apk.UGdkqyf1.I88	family_flubot
/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/base.apk.UGdkqyf1.I88	family_flubot

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.tencent.reading

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.reading
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.reading
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.reading

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/base.apk.UGdkqyf1.I88 --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/oat/x86/base.apk.UGdkqyf1.odex --compiler-filter=quicken --class-loader-context=&com.tencent.reading

ioc	pid	process
/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/base.apk.UGdkqyf1.I88	4376	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/base.apk.UGdkqyf1.I88 --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/oat/x86/base.apk.UGdkqyf1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/base.apk.UGdkqyf1.I88	4191	com.tencent.reading

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

36 api64.ipify.org
37 api64.ipify.org
Reads information about phone network operator.
Removes a system notification. 1 IoCs
evasion

Processes:

com.tencent.reading

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.tencent.reading
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tencent.reading

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.reading

flow	ioc
36	api64.ipify.org
37	api64.ipify.org

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.tencent.reading

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.reading

com.tencent.reading
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4191
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/base.apk.UGdkqyf1.I88 --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/oat/x86/base.apk.UGdkqyf1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/8GphHUgw.fkjG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/base.apk.UGdkqyf1.I88

Filesize
2.0MB

MD5
ac89082019a67c0d8dfea697649b7d01

SHA1
9cf9568be109a80e10ba82fcfae9067a3803784d

SHA256
8a447c8a6faa42d24be09983197f851b970caf6392a9a02ecda21b0d13810277

SHA512
108834466356a51337ca27cf061df22d140cc00ff9843892d25e14e7d33fb6aad938bb647af0703b2dc8f561f0f748f4bdd74351c58740ffc80a5646fa2e7838

Download Submit
/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/base.apk.UGdkqyf1.I88

Filesize
2.0MB

MD5
ac89082019a67c0d8dfea697649b7d01

SHA1
9cf9568be109a80e10ba82fcfae9067a3803784d

SHA256
8a447c8a6faa42d24be09983197f851b970caf6392a9a02ecda21b0d13810277

SHA512
108834466356a51337ca27cf061df22d140cc00ff9843892d25e14e7d33fb6aad938bb647af0703b2dc8f561f0f748f4bdd74351c58740ffc80a5646fa2e7838

Download Submit
/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/base.apk.UGdkqyf1.I88.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/oat/x86/base.apk.UGdkqyf1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/oat/x86/base.apk.UGdkqyf1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.reading/Gtfgw8g8UU/HhjIUhGUGG7ej8e/tmp-base.apk.UGdkqyf8192304599760738109.I88

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tencent.reading/shared_prefs/DHL.xml

Filesize
133B

MD5
2646b089aafe571fb385bc9d4f96e56f

SHA1
3c1025e2dc5b2f7f2df4f64f791a29417ba4d531

SHA256
27c4e547ee7d202a89e9f76c93586f7cbb4f0280f5a92ea69e86f6b0a1f01d90

SHA512
3361fbc16a7ae6fc7347ba81daadeaa7ab5a73fc6d38c4ca9988e5fbf6b0d6d4ea02432eaddd4e0b363085f82de201de7310f22e84515ac913645a7892fb2441

Download Submit
/data/user/0/com.tencent.reading/shared_prefs/DHL.xml

Filesize
176B

MD5
ff49db8324e88220e192a3932c5fd636

SHA1
75570d7f989e352dc51c82f87f8b1310b9860720

SHA256
735b315942a9c74d861aefa80c5ae267ecb5fbf3e0104f0447383f7d5e55eea3

SHA512
b183ac901d546c3af5b92226819999144b36cba3a1eef151c21cb6d3c35070923ce071c4ea1d4ca797c52e944297d3f946ef33e66d7b11b010e33909c1bef668

Download Submit
/data/user/0/com.tencent.reading/shared_prefs/DHL.xml

Filesize
240B

MD5
b69e88798d249ceb9e3c0d1d9b88b40f

SHA1
a2a759cc2d690d0a0dbfdb56e2a265d6e9ab632d

SHA256
d5633771e116b70dc3cee468be702212a2464c4c7452233283ad80d2443055e8

SHA512
4d42622af2c586b7f2f618297258e238532759609bcfcf1ea75d00a144ad081c0e2ee2303f2328d139ae030be436cd061b321d293e6ddbbe051e4862e9a55360

Download Submit