flubot | 44ea6e68941e2f3716ecaa178775d5e81008edc7a969d40c90baf85a862a7a57

Analysis

max time kernel
3341789s
max time network
157s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
31/12/2023, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2455e88ae54546cea448f901dd8127da.apk
Size 3.3MB
Sample231231-ctbnkaedhm
SHA256 44ea6e68941e2f3716ecaa178775d5e81008edc7a969d40c90baf85a862a7a57
MD5 2455e88ae54546cea448f901dd8127da
SHA1 55114bedf297893bc3022414796515e2df79d5ae
SHA512 9898801d5df8c20f6c1bc06e3233a51d461cd581b4b1989a7f184809bfd92f8e47a6dcdedf11a8209e767377b4917661af75544d8ddf3ae08175aa254e027abd
SSDEEP 49152:vzsCuCrwYD57Qyr5nsqNz+yBcvPDCkUHXCHvNwu4f3MUyN7AYpDMaSwXZ4cos:vwCdD57QyrKZOcDrjGusyZAWRS+ZR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

flubot banker discovery infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

resource	yara_rule
behavioral2/memory/4983-0.dex	family_flubot

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.qqmusic
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.qqmusic
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.qqmusic

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip	4983	com.tencent.qqmusic

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

com.tencent.qqmusic
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
PID:4983

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp-base.apk.classes8400832923351691863.zip

Path /data/data/com.tencent.qqmusic/code_cache/secondary-dexes/tmp-base.apk.classes8400832923351691863.zip
Size 878KB
SHA256 33d7dd9ef3d7a3d8e4c8811b2eedf137064085db841d7eaf60b944333c042ace
MD5 6bcedeb8a153e8862ddfd29bdf7d6124
SHA1 a234104280c24568a74a897304a1f39725c81d78
SHA512 0343900b2d067d632d33d385689f8bd4faad09d2265e68565ed7731a147584d63206338fbb6fd431772151c0d8992bce891f3c66fa80c339ad3ae3ef875decfe
SSDEEP 12288:R2YTKySEKgyFoXAxjNng/48vO1RtGVbelkPf6liEwIPZnxjWRuac+e6+rL57uV8G:rxSsyFoSRg//gR0xaucF3X4uF6+rxW2e
MD5 SHA1 SHA512 SSDEEP

Submit Download

base.apk.classes1.zip

Path /data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip
Size 2.4MB
SHA256 2047fe3136788eb566b1057d5aff87d91f337d16566e0c28f67c381c2f10d014
MD5 8c1e1e8fd268c6ef44c8e8d77f590f25
SHA1 12ce51dd7ab27c0a202bb85c95b441b2f90970bb
SHA512 c6999e0b2a4c055b203dc9212f2c89659a6e689262438896d9ef2e895fb27175dabced1368b3b6c748a4b17eb5395673ddd9eba0021b994ecd4c2c14040a43db
SSDEEP 24576:6HKomrPTI2QvrmikLPuyZ0Wrq3QuvDNVVY:YR9/UhoNVVY
MD5 SHA1 SHA512 SSDEEP

Download