flubot | 28c11bb998bf8c023a212c6518b4f8219c8583c2e79fc87d76be6fcad51b522f

Analysis

max time kernel
2679441s
max time network
170s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
23-12-2023 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28c11bb998bf8c023a212c6518b4f8219c8583c2e79fc87d76be6fcad51b522f.apk
Size

4.9MB
MD5

92891906b5842b1daac01661731116b9
SHA1

53ff2b0a928fda3439d188c9b7d2f989f7e93eec
SHA256

28c11bb998bf8c023a212c6518b4f8219c8583c2e79fc87d76be6fcad51b522f
SHA512

0b5f95a0c2022953c8ccf65808c976ea54718495952a115d557098443dc7509d419fe2c5255f05795a057061cf64bf69479c349a8361e7f4950325dc7344feb0
SSDEEP

98304:Ctbtx8eId6BxzYR3veFk1lW1zdMQ0pDDDxjUXIklfie3RrQm+jVNryVIh:Cxq8bzYR3WFk1lW1zdMPxDDxI4kXV+xF

Score

10^/10

flubot banker discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json	family_flubot

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

extend.dress.since

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	extend.dress.since
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	extend.dress.since
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	extend.dress.since

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

extend.dress.since

ioc	pid	process
/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json	4470	extend.dress.since
/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json	4470	extend.dress.since

Requests enabling of the accessibility settings. 1 IoCs

Processes:

extend.dress.since

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS extend.dress.since
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

extend.dress.since

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS extend.dress.since
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

extend.dress.since

description ioc process

Framework API call javax.crypto.Cipher.doFinal extend.dress.since

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	extend.dress.since

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	extend.dress.since

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	extend.dress.since

extend.dress.since
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4470

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json

Filesize
1.5MB

MD5
40bc23344a0f46f04cf0533ae12c86b4

SHA1
4330aa71cc6bce9eac084368d207f1aeeabbec50

SHA256
e89d9804064dfff2a9890e595825a3074f88ffcbfe7c21800a9464d2aa9ab832

SHA512
e2e32639b3080412ee5a4f898c7ed8f422e854bd8e759402d21eb2620333a60170f80e21998dbe3e2ec652a3c7dc1ff8528c52d5df7a95a35046811b752d4f45

Download Submit
/data/user/0/extend.dress.since/app_DynamicOptDex/oat/BeJsupe.json.cur.prof

Filesize
2KB

MD5
2c29785a9c8edd7c99513a8be09de7cd

SHA1
22e552444f94cf02bb73441acc3671c2d26a8d5b

SHA256
55468ad6222b4fa23985787aa5c6cb6666b988059769956d58297517c7277ce9

SHA512
f09cdced87c03738ea7dbaf920b8e2a82a1bfd3e975d28953472e2dae686e9951fe09f06d27053b9e18fd5ef9f874807a2efff966a147fb281852df06d8780eb

Download Submit