flubot | 63b0a15d6e92441701d15f76576a8f93065d1ed8f40672dce8dfde7fc788ab12

Analysis

max time kernel
784361s
max time network
161s
platform
android_x86
resource
android-x86-arm-20230824-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230824-enlocale:en-usos:android-9-x86system
submitted
25-08-2023 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63b0a15d6e92441701d15f76576a8f93065d1ed8f40672dce8dfde7fc788ab12.apk
Size

4.1MB
MD5

f2b9f29261778b009388db3ac0eb654a
SHA1

8323e7b6b63da0c470e674c9b623f57e7397c57b
SHA256

63b0a15d6e92441701d15f76576a8f93065d1ed8f40672dce8dfde7fc788ab12
SHA512

3681edf2ae761b68fcdb0c2ade75ed3741aeaff69354fc7c6c8c2339bec787b3ae902e26e7f936d871bba0776bc2d92fb03122f37fbfcd68802cce42f0647bee
SSDEEP

98304:l3D9RaM6IxWhywEvl89pRZs7pQDCSGUDOa5SBr7mk5Lo/:lZRkSbwqIi2D/tOa5dk5w

Score

10^/10

flubot banker discovery infostealer ransomware trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.moxiu.launcher/dpkfnaxldm/fflolhdffjjhhjh/base.apk.fhshddj1.jhG	family_flubot
/data/user/0/com.moxiu.launcher/dpkfnaxldm/fflolhdffjjhhjh/base.apk.fhshddj1.jhG	family_flubot

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.moxiu.launcher

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.moxiu.launcher

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.moxiu.launcher/dpkfnaxldm/fflolhdffjjhhjh/base.apk.fhshddj1.jhG --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.moxiu.launcher/dpkfnaxldm/fflolhdffjjhhjh/oat/x86/base.apk.fhshddj1.odex --compiler-filter=quicken --class-loader-context=&com.moxiu.launcher

ioc	pid	process
/data/user/0/com.moxiu.launcher/dpkfnaxldm/fflolhdffjjhhjh/base.apk.fhshddj1.jhG	4233	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.moxiu.launcher/dpkfnaxldm/fflolhdffjjhhjh/base.apk.fhshddj1.jhG --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.moxiu.launcher/dpkfnaxldm/fflolhdffjjhhjh/oat/x86/base.apk.fhshddj1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.moxiu.launcher/dpkfnaxldm/fflolhdffjjhhjh/base.apk.fhshddj1.jhG	4203	com.moxiu.launcher

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.moxiu.launcher

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.moxiu.launcher

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.moxiu.launcher

com.moxiu.launcher
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4203
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.moxiu.launcher/dpkfnaxldm/fflolhdffjjhhjh/base.apk.fhshddj1.jhG --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.moxiu.launcher/dpkfnaxldm/fflolhdffjjhhjh/oat/x86/base.apk.fhshddj1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4233

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.moxiu.launcher/dpkfnaxldm/fflolhdffjjhhjh/tmp-base.apk.fhshddj8054363385089625713.jhG

Filesize
859KB

MD5
83ccf953c9df564aec421d52fd6aa36e

SHA1
50d424f4248849edf1a2c218b50dbf8aff9ebc84

SHA256
5e61af10f5a0e189a62ec3f48d4e1cebc14596d6e785a08bee620dfb5071a84b

SHA512
cf93356abecf715cf31408f3e20243045713a5ec1b9cb0604a781e9cf82f0945c680d4622bf3cfaffbffbefdb3856f341e4d48b5c2f1dcf8ac98728e5b79d2dc

Download Submit
/data/user/0/com.moxiu.launcher/dpkfnaxldm/fflolhdffjjhhjh/base.apk.fhshddj1.jhG

Filesize
2.3MB

MD5
67f63fb53bc22fa275e2f88bc34162cb

SHA1
d1bb0f37fdd34c062632a8d7e27a15911c7b9725

SHA256
8a28d1e45d3aa5f48473afd5f8c467ba9b2297c9d214e9466f853887157e2f33

SHA512
b7cd85d949575b28bb25c3be5d14235031d3f6cdf16a7a4c30ab500691f656ab9ccde1a30a190b0cbdefad27ba3da5704f5a6dc468808aca3ff37f63f92cdfd7

Download Submit
/data/user/0/com.moxiu.launcher/dpkfnaxldm/fflolhdffjjhhjh/base.apk.fhshddj1.jhG

Filesize
2.3MB

MD5
f578217c5685e175859b17f99d3167f1

SHA1
e303b11029c4b1e215d59daa25c28044d8f0a593

SHA256
9ba6e0cc9fb9af3c0487321b309794f178d9870d52736ee0f366ef73148c198d

SHA512
f2640e3eb5e865aa2f60771510e37610ce1d3b0dfb8f77903422163553706b3a1a98e8f18ea9405267ed5e1fb308c38fc32d127854bc867e7bb630bc71aae995

Download Submit