flubot | f1bcf62ae8af19e38cfa19809e5a65cddd9b638cce72598f053774dda76bf398

Analysis

max time kernel
3519012s
max time network
161s
platform
android_x86
resource
android-x86-arm-20230621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
submitted
07-08-2023 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1bcf62ae8af19e38cfa19809e5a65cddd9b638cce72598f053774dda76bf398.apk
Size

3.8MB
MD5

930b9130e8a74dfc0b36be26fa051991
SHA1

a49e598dcb275b3a4180feaa5a89a6e1941864ee
SHA256

f1bcf62ae8af19e38cfa19809e5a65cddd9b638cce72598f053774dda76bf398
SHA512

87908ee5c7288bf426aa7b38aa5cd9b20bc2dc7027d9e945e125aa45de55fa9e833ca25ea9f6d81fa36e0ccd603f63b51728a816de93d21caeca0c4a1f945026
SSDEEP

98304:p//rDg40SwA5x2eC/Z+6br/rXwhyPQSEYjefkYZ5Vk3W3Uhjy:p/jU43h5x2e60gPlEYjZD3Pm

Score

10^/10

flubot banker discovery infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/base.apk.Ghjoj4v1.vvh	family_flubot
/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/base.apk.Ghjoj4v1.vvh	family_flubot

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.qiyi.video

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.qiyi.video

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/base.apk.Ghjoj4v1.vvh --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/oat/x86/base.apk.Ghjoj4v1.odex --compiler-filter=quicken --class-loader-context=&com.qiyi.video

ioc	pid	process
/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/base.apk.Ghjoj4v1.vvh	4196	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/base.apk.Ghjoj4v1.vvh --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/oat/x86/base.apk.Ghjoj4v1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/base.apk.Ghjoj4v1.vvh	4112	com.qiyi.video

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Reads information about phone network operator.

com.qiyi.video
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4112
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/base.apk.Ghjoj4v1.vvh --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/oat/x86/base.apk.Ghjoj4v1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/base.apk.Ghjoj4v1.vvh

Filesize
2.2MB

MD5
bec3f2025a0ae94b9a12935e8575cdb5

SHA1
920c8ca5ef6118187490cb0ba13caad7e4a584bf

SHA256
da08a36c43aa87c80c000d08c694d131999dc748853f907ff7d55c017f1d5c36

SHA512
8ac5e4a1a0bef5c0ba3df32d089a05eba6ef773262e2968dc2cb5e44cf3c0caeb50ce0b37f6672fecd3a50b4dac70242db7f89de0839866d86519be476c85f4c

Download Submit
/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/base.apk.Ghjoj4v1.vvh

Filesize
2.2MB

MD5
0b4d3de8f586f0925eda275d5ebf3727

SHA1
ab2d6234d53020d2bd4238e4ab525168ade3618f

SHA256
8f3f7b5a292efc43392d516eeabd8a24fb45cfe1b835ed25184deffe0b6d0a16

SHA512
d97869e7b32a1e19c09f96ea82e2426649e793e6d970c3feec7b366541b03ac797ab5a94e9abc5565d4c2cbedc6fe09025f6d5170a15592914df2f063e13424d

Download Submit
/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/base.apk.Ghjoj4v1.vvh.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/oat/x86/base.apk.Ghjoj4v1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/oat/x86/base.apk.Ghjoj4v1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/tmp-base.apk.Ghjoj4v4282415475193664956.vvh

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qiyi.video/hkuGnjd84n/fhrz8bjeJd4jusw/whhomuof.hIbw

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.qiyi.video/shared_prefs/DHL.xml

Filesize
133B

MD5
716824bb225eba77f2de17aa371f557b

SHA1
77975deec4227c249536f8aa262297c195df3bf8

SHA256
481d6d76f7cf7279b2554f2df19e37669cf99bc3d92f291fefeba454297e4c47

SHA512
b817bdebdf19941476044a68a9c1e4d3a307abfa01fd54eb3d5cd5e8793a88f47e783713ada46dc3c2106524187fe6c0a0aa74008be520e05067d02584512b46

Download Submit
/data/user/0/com.qiyi.video/shared_prefs/multidex.version.xml

Filesize
306B

MD5
79c0651bd091c4f5a43162ead35c80f4

SHA1
51e221fae9b497aae8d02e2b1accfd7f241306bc

SHA256
1fcbdb840472ef75bb0f35ecb1e723b3e8978852fa510df625c5a4618a2324fa

SHA512
b0b1fa77981e814a51bd5ef18ff8c6a320c847ef01add9ce7af2405ca09056fe40c2b282ccd1713b9cb999701fd361bee0828f319d48015061de152dd88b518f

Download Submit