flubot | bbe7f3bc15429196cc01935295ff6a7867b2fc501d1896b01afe62fbce2ed314

Analysis

max time kernel
2907698s
max time network
159s
platform
android_x86
resource
android-x86-arm-20230621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
submitted
31-07-2023 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbe7f3bc15429196cc01935295ff6a7867b2fc501d1896b01afe62fbce2ed314.apk
Size

3.6MB
MD5

5b38cb30eb591eeefd6893b0ec04d44b
SHA1

668c2bb8cb3d3aa9520c90b85cfb33becb2b3aea
SHA256

bbe7f3bc15429196cc01935295ff6a7867b2fc501d1896b01afe62fbce2ed314
SHA512

03602474872b49d22370db4eace3374c7f5a726ac128400ab1ec1df89af40a48d33427d9bf6b3bafbea5f1724b1b4f008c2010ac1a8b6c88a99f0c8b1678a4ca
SSDEEP

98304:9UrPJfylp4QhegEGmJHgi3nheMSQXl7rXdLdO5e3W3Y:9dlSQhegAXHDZOs3J

Score

10^/10

flubot banker discovery infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/base.apk.vgkdhfl1.hfv	family_flubot
/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/base.apk.vgkdhfl1.hfv	family_flubot

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.qq.reader

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.qq.reader

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/base.apk.vgkdhfl1.hfv --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/oat/x86/base.apk.vgkdhfl1.odex --compiler-filter=quicken --class-loader-context=&com.qq.reader

ioc	pid	process
/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/base.apk.vgkdhfl1.hfv	4204	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/base.apk.vgkdhfl1.hfv --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/oat/x86/base.apk.vgkdhfl1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/base.apk.vgkdhfl1.hfv	4145	com.qq.reader

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Reads information about phone network operator.

com.qq.reader
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4145
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/base.apk.vgkdhfl1.hfv --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/oat/x86/base.apk.vgkdhfl1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/base.apk.vgkdhfl1.hfv

Filesize
2.2MB

MD5
532428dfadc821ae2b70e8fe055025e7

SHA1
17ab439d30f624e8c30276de13d36a635ee9f8be

SHA256
2abc52c43e693c2171bc77c4bc505364b20c270ee80bdc7c06f32096008031c6

SHA512
005e337dce735d4a995baac9ea800f629076d3f6a3c5cb8ccf1eb1dba8ef149c7b9577ef44718ad34ffef6ba109b87e60ab83617d25b9046cd5751ee147e4538

Download Submit
/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/base.apk.vgkdhfl1.hfv

Filesize
2.2MB

MD5
c7ea97ddf2d3b3760db476d88785a44e

SHA1
dcaa3795d2c2efbb1fedd8ef1ac83ab818dd1a10

SHA256
1f30dcdb244fadc68d100f87833db42fb4191fbbd7a08627ed8cb95beeae223c

SHA512
d7f227b86dd117f607bab5937a6ef29a69ee1cae3c7ee5a4b9ea4d44533bba8ec36fb0a5d12acafc1bfcf6df04edd69e31a4259077a4cff47aa2096493fc494f

Download Submit
/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/base.apk.vgkdhfl1.hfv.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/ljizgvdm.gh5f

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/oat/x86/base.apk.vgkdhfl1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/oat/x86/base.apk.vgkdhfl1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qq.reader/bg9vI94ofk/h4sheln9ohdoo98/tmp-base.apk.vgkdhfl778726759824176364.hfv

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qq.reader/shared_prefs/DHL.xml

Filesize
133B

MD5
8b305d5158dc16dfe30e6ea647cfb57c

SHA1
831d57cf28ce14334bf1b0711511db3c461fd87c

SHA256
404a1fac5f420633c3ed1e1a8f3879975288f6ab1e7c645eb97e0785daa091dd

SHA512
438949ecafa333f0fe0b1f58620a11338dff341522458ed6650fe43c94910cd8c2efe415a960fcd95267f4b784f2029a2b57264570f8c9f933dbe494bb525d62

Download Submit
/data/user/0/com.qq.reader/shared_prefs/multidex.version.xml

Filesize
307B

MD5
c0d97a0c02e9bd41385102f182279402

SHA1
481a89e47b47d4d12ab3b702f8bbca64e1677d96

SHA256
553f4f6e2f7908bcb3fd6cd7873b9818ea977186d3c46b37bac32fcf529f4295

SHA512
83b4eb88e300457c2139d0e73ac8a1d3f440003c5e221d90f5699151ce4f77be317eb00bf9270a53ca67cb3d2e5f69267636a27418fb488a607f89177fb717cd

Download Submit