flubot | 476efe162f8ca4f0c7ad83f3602ac1ee661f97312fd00d71d765469425dbc60c

Analysis

max time kernel
3610692s
max time network
163s
platform
android_x86
resource
android-x86-arm-20230621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
submitted
08-08-2023 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

476efe162f8ca4f0c7ad83f3602ac1ee661f97312fd00d71d765469425dbc60c.apk
Size

3.9MB
MD5

601bb3c40ab4d7c3c698db4ac85a8bd9
SHA1

569c652e7c06a92f6c54b1e0350775437e2ac0d6
SHA256

476efe162f8ca4f0c7ad83f3602ac1ee661f97312fd00d71d765469425dbc60c
SHA512

d79ae0be8150af95f36d683c44d18448653f3836748bb8f41309d888fc40342c9194b935c4106479f5a4d59ab05bdd943a6f02e6657c6f9248a7c046dc78c855
SSDEEP

98304:vKZZCKUblz6StKSoJpX6Cvl7xoI1UiPPB8F19UnA/lz3/77z:vaoblz3t5oJRN7x8Sp5Alz

Score

10^/10

flubot banker discovery infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/base.apk.mozhlhh1.zYn	family_flubot
/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/base.apk.mozhlhh1.zYn	family_flubot

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.moxiu.launcher

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.moxiu.launcher

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/base.apk.mozhlhh1.zYn --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/oat/x86/base.apk.mozhlhh1.odex --compiler-filter=quicken --class-loader-context=&com.moxiu.launcher

ioc	pid	process
/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/base.apk.mozhlhh1.zYn	4253	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/base.apk.mozhlhh1.zYn --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/oat/x86/base.apk.mozhlhh1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/base.apk.mozhlhh1.zYn	4142	com.moxiu.launcher

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Reads information about phone network operator.

com.moxiu.launcher
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4142
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/base.apk.mozhlhh1.zYn --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/oat/x86/base.apk.mozhlhh1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4253

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/amhxnomn.fjfG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/base.apk.mozhlhh1.zYn

Filesize
2.3MB

MD5
70bf385ca2317d17dbdea5c61bbc0d75

SHA1
25c8c09e0a0e913c3e11d34fc241a312d06064fa

SHA256
1f019d2069b93a89a679c5b3de681819246e3a8f28353cf0ec31282a42251f6b

SHA512
0c8a42f6620b65749ea5c3e423e29e6c3bf00557ed658a9e631247ec2ab07946116f85c7a075b2729185b91a8b2d3d980c0033cdd32d82af85ac7440bcfe4f37

Download Submit
/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/base.apk.mozhlhh1.zYn

Filesize
2.3MB

MD5
a0a9a8c4f5c08af1511d92912d58b025

SHA1
d3ee5ad2a3e87cc0fc8bcb9aa2aa4dc20774a512

SHA256
1f9f73e14dcd0ea374be1f7feab6e3c390a17e09a1c4082e5a8963d51717ba4a

SHA512
b30f7f64884679eb9844b640107bb5144143aad1c60f8027a9f53be14d7ee37531a082fdca326bd5236070f478b68f022a117e6bd35a98ae5517c0adb2af8a39

Download Submit
/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/base.apk.mozhlhh1.zYn.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/oat/x86/base.apk.mozhlhh1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/oat/x86/base.apk.mozhlhh1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.moxiu.launcher/mabmGjnxgk/lookxvxsosxmjcx/tmp-base.apk.mozhlhh4973956668127303812.zYn

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.moxiu.launcher/shared_prefs/DHL.xml

Filesize
133B

MD5
f431a3ed3ecd09086a6b80b5f2e1f9b0

SHA1
bb0e21451db642cafcb3b4f1a67df35ce2a29951

SHA256
001becbb49e1e4f9c96f87d80032c2d23f1628017029ecc3de66a256514fe466

SHA512
c0413d5877af2f0d4c57239fa080c1ff4988e4bc5dfe58552db5526b6eb52db617222ab439ef0aeb1973862a36f6b2ab126398229bc220ce1e15380b72c9d750

Download Submit
/data/user/0/com.moxiu.launcher/shared_prefs/multidex.version.xml

Filesize
307B

MD5
1abb489399515f2e6c64b0911d414c52

SHA1
a9e16db3338ceab5b451cb7394ab89b3e022da3a

SHA256
c52beef151412ef603c05c96b058970eda28e13a21e60c895b6e90630f3c91e7

SHA512
96a76f610d95fa747c10c694fc8a011c4cc0dad00ad00e7675ab24a67d0525b41c72c8606e6543cc45b6dfefce184dbef7ea5ef31c4d48c94d5fb454ba673526

Download Submit