flubot | 53721f5f5eb05250b7d7e599983dc34d2ea2061e8032d4be8fcf9693452757a3

Analysis

max time kernel
150s
max time network
161s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
13-03-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53721f5f5eb05250b7d7e599983dc34d2ea2061e8032d4be8fcf9693452757a3.apk
Size

3.3MB
MD5

b670a3277e69ff3f6aa23c0116675cd9
SHA1

f7a6aab778d3a3a348cbb329ef32ed3c492c1ea8
SHA256

53721f5f5eb05250b7d7e599983dc34d2ea2061e8032d4be8fcf9693452757a3
SHA512

72062267c183060db58f21af96a6d8350cac37b34e85d523576b3a6000d14e515547c57916452b11d4a6370a3e0e4377a80a556956944c9f909e2ba427f2d80b
SSDEEP

98304:B0zGt3ZuI7y690JAD/oD4/mQs6/LTdCHZs:B+GfuI7y2oDrq

Score

10^/10

flubot banker collection discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

resource	yara_rule
behavioral3/memory/4609-0.dex	family_flubot

Makes use of the framework's Accessibility service 2 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.qqmusic

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip	4609	com.tencent.qqmusic

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.qqmusic

com.tencent.qqmusic
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4609

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
2.4MB

MD5
8ea2dc64e9e7a2740c3e5effe242615e

SHA1
39882a484ee4dbb7ef46554893ce7822b5656eb1

SHA256
d52975758f8799644df1ab42958abe05c3cbb3bd2b436d4ec5c18c2961747300

SHA512
d598e0cd00e0cb25d3a6db7d9ca4226929f843647ccd08dacc0ff40d842d6dfbc3cb00760692787f21cc178d1b76c4ae1db67f44ff7615c66c6f46b705108390

Download Submit
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/tmp-base.apk.classes4018771420249980020.zip

Filesize
149KB

MD5
c2ae0188b74c9e5feb2bfcdaadaeabe6

SHA1
97b93b77fe9526d9c38dad3482b776f421c7d7d8

SHA256
c982c5205be87d3c266cdc141bb2756f5b5028652631fca8b7b6835a7cb7cb94

SHA512
e6e8a4111f673a46e7b17ee0725d5b4daa9e8c128119dc03cd499d4f2c3ca361b99b99ed9243e157e6579312dca5825ba8cad3ff187f900cbdb99565493076d8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads