flubot | 28c11bb998bf8c023a212c6518b4f8219c8583c2e79fc87d76be6fcad51b522f

Analysis

max time kernel
2679428s
max time network
162s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
23-12-2023 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28c11bb998bf8c023a212c6518b4f8219c8583c2e79fc87d76be6fcad51b522f.apk
Size

4.9MB
MD5

92891906b5842b1daac01661731116b9
SHA1

53ff2b0a928fda3439d188c9b7d2f989f7e93eec
SHA256

28c11bb998bf8c023a212c6518b4f8219c8583c2e79fc87d76be6fcad51b522f
SHA512

0b5f95a0c2022953c8ccf65808c976ea54718495952a115d557098443dc7509d419fe2c5255f05795a057061cf64bf69479c349a8361e7f4950325dc7344feb0
SSDEEP

98304:Ctbtx8eId6BxzYR3veFk1lW1zdMQ0pDDDxjUXIklfie3RrQm+jVNryVIh:Cxq8bzYR3WFk1lW1zdMPxDDxI4kXV+xF

Score

10^/10

flubot banker discovery infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

Processes:

resource	yara_rule
/data/data/extend.dress.since/app_DynamicOptDex/BeJsupe.json	family_flubot

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

extend.dress.since

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	extend.dress.since
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	extend.dress.since
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	extend.dress.since

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

extend.dress.since

ioc	pid	process
/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json	4992	extend.dress.since
/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json	4992	extend.dress.since

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

extend.dress.since

description ioc process

Framework API call javax.crypto.Cipher.doFinal extend.dress.since

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	extend.dress.since

extend.dress.since
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/extend.dress.since/app_DynamicOptDex/BeJsupe.json

Filesize
1.5MB

MD5
e2993d2a3cd519c197e808c18750fd07

SHA1
22d1cc1b7db89f1dfc1892a954778399ac903005

SHA256
7cfd37d111f15e729ad5d9bd8c831771e2157d68808e51ec2470437087636c73

SHA512
7ea089e7169b574e8d8ff524d0f9742f1eee6e901a2dc9fb92d3160b517db46cebe7b4549ab250426560d27227eba57780e0cd3bdae63b3e3dc5070f5ae6ac0f

Download Submit
/data/data/extend.dress.since/app_DynamicOptDex/BeJsupe.json

Filesize
1.5MB

MD5
40bc23344a0f46f04cf0533ae12c86b4

SHA1
4330aa71cc6bce9eac084368d207f1aeeabbec50

SHA256
e89d9804064dfff2a9890e595825a3074f88ffcbfe7c21800a9464d2aa9ab832

SHA512
e2e32639b3080412ee5a4f898c7ed8f422e854bd8e759402d21eb2620333a60170f80e21998dbe3e2ec652a3c7dc1ff8528c52d5df7a95a35046811b752d4f45

Download Submit
/data/data/extend.dress.since/app_DynamicOptDex/oat/BeJsupe.json.cur.prof

Filesize
2KB

MD5
90ebe009c7c723901960d3193007c701

SHA1
f6b35e4d22d7ed9aea94a0b8356268bee30c3cc8

SHA256
096e27d19823bd40017e2e0536c384245514fe03da27f16a76939d0d26a9e39d

SHA512
9e8b99dff0056085946baf8eba496cce1905028f89d0fea76e49e91b23d49edfd9e21b92c629762d81203c497c4efa4c3fd48853920c8ed4778601a0e6e4c89e

Download Submit