flubot | 53721f5f5eb05250b7d7e599983dc34d2ea2061e8032d4be8fcf9693452757a3

Analysis

max time kernel
151s
max time network
161s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
14-03-2024 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53721f5f5eb05250b7d7e599983dc34d2ea2061e8032d4be8fcf9693452757a3.apk
Size

3.3MB
MD5

b670a3277e69ff3f6aa23c0116675cd9
SHA1

f7a6aab778d3a3a348cbb329ef32ed3c492c1ea8
SHA256

53721f5f5eb05250b7d7e599983dc34d2ea2061e8032d4be8fcf9693452757a3
SHA512

72062267c183060db58f21af96a6d8350cac37b34e85d523576b3a6000d14e515547c57916452b11d4a6370a3e0e4377a80a556956944c9f909e2ba427f2d80b
SSDEEP

98304:B0zGt3ZuI7y690JAD/oD4/mQs6/LTdCHZs:B+GfuI7y2oDrq

Score

10^/10

flubot banker collection discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

resource	yara_rule
behavioral2/memory/5057-0.dex	family_flubot

Makes use of the framework's Accessibility service 2 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.qqmusic

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip	5057	com.tencent.qqmusic

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.qqmusic

com.tencent.qqmusic
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:5057

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.qqmusic/code_cache/secondary-dexes/tmp-base.apk.classes3165710897397257640.zip

Filesize
878KB

MD5
51b99ac0544950de7fe75a76295643d0

SHA1
c0eab9c85915fd25839562c7970a71f789c58912

SHA256
64ba65f57053770b098c015482024240dde1e5670bd3e3f02a0fe3da161fd6c7

SHA512
9f64d7d0348e6b4cd954265c4c2a0c89ca2be1890968e670db636429ce18456a6d9995e297ef852aad934b360da971fe6af9570dce62c58acd28d96d9c8f5476

Download Submit
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
2.1MB

MD5
997f8418958b9237109ebda5ecf5d83d

SHA1
9a3b1985052ba31be7e103772f5b4c4e2d7ffff1

SHA256
f94de332349cf3576ca35059368a70fad9c7f5aaf7d47a64816e7c080b6d0056

SHA512
79730ccc3b5643e4dc09cb4852d8bed218095007f313eaf584649f836d2afd6697300ad7c002b6f26fed4bdf5d72cfcc99d371462a277f3da3ca793c985d9588

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads