flubot | a3953a902ba6dd604f6da33c0dfb88fd504dfbc8e1d0bb23ba6ee9f77190b567

Analysis

max time kernel
153s
max time network
153s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
04-03-2024 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2ecb711979b80d5b528aa07c3f21b47.apk
Size

3.1MB
MD5

b2ecb711979b80d5b528aa07c3f21b47
SHA1

1247f20610a9ebe95d6b461faa7746d487bec905
SHA256

a3953a902ba6dd604f6da33c0dfb88fd504dfbc8e1d0bb23ba6ee9f77190b567
SHA512

2a2b050b0a0e91f9db77900963a91a0918e367980fa4515b1cadfd3a58fa4c168fa9455f41e44a26e266cdc83c2cfb1d88003d7d4a1efdc4af9d3fb7b43d858e
SSDEEP

49152:YjjZ2WjsJTBVAnZ7Yc0UavlSLz+Cq1z6SYsQ97MqK62WhOhzOYNw34mRyFc1KEOL:YjpyQZU5Sex68QLK/yP3PcQ/O0A78Gl

Score

10^/10

flubot banker collection discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.qq.reader/code_cache/secondary-dexes/base.apk.classes1.zip	family_flubot

Makes use of the framework's Accessibility service 2 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

com.qq.reader

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.qq.reader

Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.qq.reader

ioc pid process

/data/user/0/com.qq.reader/code_cache/secondary-dexes/base.apk.classes1.zip 4377 com.qq.reader
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.qq.reader

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.qq.reader

ioc	pid	process
/data/user/0/com.qq.reader/code_cache/secondary-dexes/base.apk.classes1.zip	4377	com.qq.reader

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.qq.reader

com.qq.reader
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4377

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.qq.reader/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
1.2MB

MD5
3198712a56d21d3b52f8d79e9936a340

SHA1
b1b3d2eec2da520da25684677309b6bacc3b67e8

SHA256
cfb9fe58886994e0a16dc6e45c31ed8cf187e25171b18dd5c9ba074913fb5e2d

SHA512
095c9bd537011cd3ed69ef3eac539e7114660f6731c368a414571588ac689d2c66c6554c0702293cffde7b4650190ffd939b715c208151431f29c117e40c8e98

Download Submit
/data/user/0/com.qq.reader/code_cache/secondary-dexes/tmp-base.apk.classes6170847654416584557.zip

Filesize
878KB

MD5
af8aee6b0066a7058e12c9ee36692483

SHA1
544f8dc70c8eb4ff01cff8084f8f420eee27f821

SHA256
43f449e4b73822017e3238688709e54a5880e1c66f9b1452339796bbd9b842ac

SHA512
60161538e2f86132f657abf48e3c026911c8c15dec2ff17dca1263396ee37445eab9e77f4c2ee1f57e38c7587ae61de234c6bdfa9d4aa5b6637896606225ebc4

Download Submit