flubot | 06b523da0f9d2d52ddf3b2c76a8be5e4084bd921e363b36c7e3bb3c456aa5a39

Analysis

max time kernel
150s
max time network
158s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
26-01-2024 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06b523da0f9d2d52ddf3b2c76a8be5e4084bd921e363b36c7e3bb3c456aa5a39.apk
Size

3.9MB
MD5

2a0df65d94ec05fcd635ff6f1dd413e4
SHA1

9db282665315e2ac6a81631428d8db5d464d6364
SHA256

06b523da0f9d2d52ddf3b2c76a8be5e4084bd921e363b36c7e3bb3c456aa5a39
SHA512

ce5b71f643c8ddfd0c83fed37f740a2e7f75819abaa46092c4409de1f19fc8129a0b8f9b3e79f51f83330243179ca8ffdc8f1346694f70241718afa6ccccca3f
SSDEEP

98304:/gkW89iS413fkXCl96rK8r9nG/UD3MnjTdTWeutF+6WBaT86h4sQTr:/NW892czK8RnrcjvACBaTNh4f

Score

10^/10

flubot banker discovery infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.moxiu.launcher/fdYmzghfjf/bhcbhoxjhfgznnf/base.apk.bfvjhha1.hzf	family_flubot
/data/user/0/com.moxiu.launcher/fdYmzghfjf/bhcbhoxjhfgznnf/base.apk.bfvjhha1.hzf	family_flubot

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Makes use of the framework's Accessibility service 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

com.moxiu.launcher

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.moxiu.launcher

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.moxiu.launcher/fdYmzghfjf/bhcbhoxjhfgznnf/base.apk.bfvjhha1.hzf --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.moxiu.launcher/fdYmzghfjf/bhcbhoxjhfgznnf/oat/x86/base.apk.bfvjhha1.odex --compiler-filter=quicken --class-loader-context=&com.moxiu.launcher

ioc	pid	process
/data/user/0/com.moxiu.launcher/fdYmzghfjf/bhcbhoxjhfgznnf/base.apk.bfvjhha1.hzf	4278	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.moxiu.launcher/fdYmzghfjf/bhcbhoxjhfgznnf/base.apk.bfvjhha1.hzf --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.moxiu.launcher/fdYmzghfjf/bhcbhoxjhfgznnf/oat/x86/base.apk.bfvjhha1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.moxiu.launcher/fdYmzghfjf/bhcbhoxjhfgznnf/base.apk.bfvjhha1.hzf	4248	com.moxiu.launcher

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.moxiu.launcher

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.moxiu.launcher

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.moxiu.launcher

com.moxiu.launcher
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4248

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.moxiu.launcher/fdYmzghfjf/bhcbhoxjhfgznnf/base.apk.bfvjhha1.hzf --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.moxiu.launcher/fdYmzghfjf/bhcbhoxjhfgznnf/oat/x86/base.apk.bfvjhha1.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4278

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.moxiu.launcher/fdYmzghfjf/bhcbhoxjhfgznnf/tmp-base.apk.bfvjhha3682614617811265967.hzf
Filesize
859KB

MD5
15712a76800c34ca507d820497b54087

SHA1
0c1e5074df618d01e55f015765b11f5b71cbd3d0

SHA256
b85949c5f82d6e435f440f88a16d8bd8c22fe7bc289a66ea19b179ce7aaaf1ee

SHA512
921f5cea7945daccb82de2b11a2c810fe9af4218066f3d3ed2be47956a8cfacf6af5f9bf0c0a68528f2d83607122d28d4ec12aa57b63329d2fd2e28d3527cba0

Download Submit
/data/user/0/com.moxiu.launcher/fdYmzghfjf/bhcbhoxjhfgznnf/base.apk.bfvjhha1.hzf
Filesize
2.3MB

MD5
d3f9fbfafca951c5f8e6d20052e6642c

SHA1
47b5a52d5c36aa05b67ac04fccd5352f2d329911

SHA256
72b3fe6a2452262be22e71957cf458ad611a55cd019a31565e670ba361145cd7

SHA512
0e7dbe6516e7b014a5ed89165b5e85dcf77d9035f51c29591044a7368ec0f5425f12ba59f556bac7f5ead31178dd5d47836185040a94ce6729896ceb97391de1

Download Submit
/data/user/0/com.moxiu.launcher/fdYmzghfjf/bhcbhoxjhfgznnf/base.apk.bfvjhha1.hzf
Filesize
2.3MB

MD5
64437ca75168f897ef93759288b71e37

SHA1
e873d43733d6837d289b2317ecaf4d7e90bd9cec

SHA256
d273f369773cc2c51118d0ce94a061f7fefddc2eb650d84736c873d39867a658

SHA512
16a3a51fb029d06e2631b5129b944e8dd68ab9e20c0c2860246b7578ef08e3f5b106b99f2d6b0283bcce7110a12ce61216cde6c695974ebecb11ab0dfeb21e4d

Download Submit