flubot | 53721f5f5eb05250b7d7e599983dc34d2ea2061e8032d4be8fcf9693452757a3

Analysis

max time kernel
150s
max time network
161s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
13-03-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53721f5f5eb05250b7d7e599983dc34d2ea2061e8032d4be8fcf9693452757a3.apk
Size

3.3MB
MD5

b670a3277e69ff3f6aa23c0116675cd9
SHA1

f7a6aab778d3a3a348cbb329ef32ed3c492c1ea8
SHA256

53721f5f5eb05250b7d7e599983dc34d2ea2061e8032d4be8fcf9693452757a3
SHA512

72062267c183060db58f21af96a6d8350cac37b34e85d523576b3a6000d14e515547c57916452b11d4a6370a3e0e4377a80a556956944c9f909e2ba427f2d80b
SSDEEP

98304:B0zGt3ZuI7y690JAD/oD4/mQs6/LTdCHZs:B+GfuI7y2oDrq

Score

10^/10

flubot banker collection discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

resource	yara_rule
behavioral3/memory/4586-0.dex	family_flubot

Makes use of the framework's Accessibility service 2 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.qqmusic

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip	4586	com.tencent.qqmusic

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.qqmusic

com.tencent.qqmusic
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4586

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
2.4MB

MD5
8ea2dc64e9e7a2740c3e5effe242615e

SHA1
39882a484ee4dbb7ef46554893ce7822b5656eb1

SHA256
d52975758f8799644df1ab42958abe05c3cbb3bd2b436d4ec5c18c2961747300

SHA512
d598e0cd00e0cb25d3a6db7d9ca4226929f843647ccd08dacc0ff40d842d6dfbc3cb00760692787f21cc178d1b76c4ae1db67f44ff7615c66c6f46b705108390

Download Submit
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/tmp-base.apk.classes3485066616082036583.zip

Filesize
158KB

MD5
8d82bcbe3af1e2ca03d45d487e59ac7a

SHA1
0bea0c2d85878bbf7592c2c0b6b33ab1a9efb216

SHA256
e628ef7deca9ee6491736d3d07c3f54c3a38b13d6d7d0c5800a703ee0990101b

SHA512
592d06cc9de0efaffd94daade9a888adc60afe5d741ff1f81bc2c6abbf2e745a3f5755171763355b6fe6d59e11a65a35a4ed7213b2f3a6651ef432ad1c7998b4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads