flubot | a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d

Analysis

max time kernel
151s
max time network
162s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
13-03-2024 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d.apk
Size

3.8MB
MD5

c23426edaf37a2fc6fc3a6e5daa17bfa
SHA1

a362e1aaf8bc7a7491b10eab252c3b7ee8532a46
SHA256

a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d
SHA512

98b78e62a63d87ddc55722658e85acb5f9ba4b792578ca8868e8214e04f4336e9728bec2c386b6afbac4f2183f8232d6e958b215c5c0948746f4254d32ffa2ff
SSDEEP

98304:e5bwkHNRfCwdA0cduVE7AxeQrUsVinobTdp6n:eFo0cdu+AxeMxTdwn

Score

10^/10

flubot banker collection discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.didiglobal.passenger/code_cache/secondary-dexes/base.apk.classes1.zip	family_flubot

Makes use of the framework's Accessibility service 2 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

com.didiglobal.passenger

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.didiglobal.passenger

Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.didiglobal.passenger

ioc pid process

/data/user/0/com.didiglobal.passenger/code_cache/secondary-dexes/base.apk.classes1.zip 4438 com.didiglobal.passenger
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.didiglobal.passenger

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.didiglobal.passenger

ioc	pid	process
/data/user/0/com.didiglobal.passenger/code_cache/secondary-dexes/base.apk.classes1.zip	4438	com.didiglobal.passenger

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.didiglobal.passenger

com.didiglobal.passenger
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4438

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.didiglobal.passenger/code_cache/secondary-dexes/base.apk.classes1.zip
Filesize
2.4MB

MD5
225a4f4ef23e049c8eeef4d9188e5559

SHA1
c9bce30752acf148b0941e187ccf94bd9b410004

SHA256
e2c47c6eaca1f0b8454ec5091a37000e351b1565c20636e30b209d0cbf1de077

SHA512
615d9d1ffc81728a0b5c4f77ef20444f563aa6c81aaaacce3286f99f1c76d737da63750110fb3cf78c187d800d9116c261ac6c26b7038e5cfe33e741f936b0d7

Download Submit
/data/user/0/com.didiglobal.passenger/code_cache/secondary-dexes/tmp-base.apk.classes5040436047062713635.zip
Filesize
879KB

MD5
10bcc68f7c618ee38f51f7cd4c98c0e3

SHA1
a7252ce3c5c14813547fe3fea2b4ca760ff6c1f1

SHA256
11674907889ea9ec99a3ccbf83812fc5b41095fccf537b1349489a68ee95f29f

SHA512
1528774a9fde9a896c0e1aab207c3bb93d7a7b81d366caee7b4e90607ee083652f2dc77adde7b8bfe90d19376d01ba51405839e8cb387ea6a7acd3b6d6efc84c

Download Submit