flubot | 0c71f0d68606997d53086b5e7149b2ade9db3cff22969f518e7694ecad4eda18

Analysis

max time kernel
150s
max time network
158s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
19-01-2024 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67566e6554dc10d6d3f043a80bed57bf.apk
Size

3.1MB
MD5

67566e6554dc10d6d3f043a80bed57bf
SHA1

1cfe27325f5860d304163eba7ed57f26a64a1c8a
SHA256

0c71f0d68606997d53086b5e7149b2ade9db3cff22969f518e7694ecad4eda18
SHA512

d47064c757a6bbf80bb59fb429f1cb34042bdc64ccf4f69273137e75f0c08a5ace39571cc8c6fe727d6c6e6c8c37303d3cf82f33fe2bbe9b820ed6d3dfc0656b
SSDEEP

49152:dMPkOWjsJTBVAnZ7Yc0UavlSLz+Cq1z6SYsQ97MqKJ2WhOhzOXNwskZRyFc1KEOS:dM0yQZU5Sex68QLKSyOsccQ/O0A78Go

Score

10^/10

flubot banker discovery infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.qq.reader/code_cache/secondary-dexes/base.apk.classes1.zip	family_flubot
/data/user/0/com.qq.reader/code_cache/secondary-dexes/base.apk.classes1.zip	family_flubot

Makes use of the framework's Accessibility service 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

com.qq.reader

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.qq.reader

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qq.reader/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qq.reader/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&com.qq.reader

ioc	pid	process
/data/user/0/com.qq.reader/code_cache/secondary-dexes/base.apk.classes1.zip	4259	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qq.reader/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qq.reader/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.qq.reader/code_cache/secondary-dexes/base.apk.classes1.zip	4202	com.qq.reader

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.qq.reader

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.qq.reader

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.qq.reader

com.qq.reader
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4202

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qq.reader/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qq.reader/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4259

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.qq.reader/code_cache/secondary-dexes/tmp-base.apk.classes7976337254737458766.zip
Filesize
521KB

MD5
55bbf380d6a2e5b52af95ce291165543

SHA1
95588b938389c9db5accee4454d5a1e689816e98

SHA256
c0b93014b18baa719217b3df595847139af8cf86ee65045f5eb5c052266bbd83

SHA512
efaa51c73b4c4afc40861a465c129c100abb4c9a7e15de81a4a9ac4fcba88377d474947e385ae0ae914d224618402c261acad418ccadddd1354e93b4dee27263

Download Submit
/data/user/0/com.qq.reader/code_cache/secondary-dexes/base.apk.classes1.zip
Filesize
2.4MB

MD5
11609be216b5d68538c43ea3d208dc48

SHA1
9bcd69847267acf0680158e153b2b398a8194fc5

SHA256
7344566ccd256686f2bbf40a97b441a4c89e6ef21fefc2c761002c6751213d23

SHA512
ef9ab1cda639eb692bc10298bb6ff6a71262da8caa579f9aa1176cbc03047714d821d6faeda25f0c4d57a2ea4edd4385126bf815133fc73f8f62de42c52c40c5

Download Submit
/data/user/0/com.qq.reader/code_cache/secondary-dexes/base.apk.classes1.zip
Filesize
2.4MB

MD5
aa09de680eec3e37e520f9cc99f6df4f

SHA1
6415fe1e6ef75360667bdf406bbbb484610c6dd2

SHA256
47d7a2d9acdc4c87289d90c63f25ecda1ce272fd81a397af6953618e40114502

SHA512
3ccc85be780b5558d0d0d3e4d92b2c3a95399b89ceef5eea37f5479f4ed890adbc4b4c7bd07d16eea8aa37759c5538a225d1239b55adafeb99fe8e8e9d7be404

Download Submit