flubot | 53721f5f5eb05250b7d7e599983dc34d2ea2061e8032d4be8fcf9693452757a3

Analysis

max time kernel
154s
max time network
165s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
14-03-2024 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53721f5f5eb05250b7d7e599983dc34d2ea2061e8032d4be8fcf9693452757a3.apk
Size

3.3MB
MD5

b670a3277e69ff3f6aa23c0116675cd9
SHA1

f7a6aab778d3a3a348cbb329ef32ed3c492c1ea8
SHA256

53721f5f5eb05250b7d7e599983dc34d2ea2061e8032d4be8fcf9693452757a3
SHA512

72062267c183060db58f21af96a6d8350cac37b34e85d523576b3a6000d14e515547c57916452b11d4a6370a3e0e4377a80a556956944c9f909e2ba427f2d80b
SSDEEP

98304:B0zGt3ZuI7y690JAD/oD4/mQs6/LTdCHZs:B+GfuI7y2oDrq

Score

10^/10

flubot banker collection discovery evasion infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

resource	yara_rule
behavioral3/memory/4374-0.dex	family_flubot

Makes use of the framework's Accessibility service 2 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.qqmusic

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip	4374	com.tencent.qqmusic

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.qqmusic

com.tencent.qqmusic
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4374

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
2.4MB

MD5
8ea2dc64e9e7a2740c3e5effe242615e

SHA1
39882a484ee4dbb7ef46554893ce7822b5656eb1

SHA256
d52975758f8799644df1ab42958abe05c3cbb3bd2b436d4ec5c18c2961747300

SHA512
d598e0cd00e0cb25d3a6db7d9ca4226929f843647ccd08dacc0ff40d842d6dfbc3cb00760692787f21cc178d1b76c4ae1db67f44ff7615c66c6f46b705108390

Download Submit
/data/user/0/com.tencent.qqmusic/code_cache/secondary-dexes/tmp-base.apk.classes5282995163686258459.zip

Filesize
878KB

MD5
51b99ac0544950de7fe75a76295643d0

SHA1
c0eab9c85915fd25839562c7970a71f789c58912

SHA256
64ba65f57053770b098c015482024240dde1e5670bd3e3f02a0fe3da161fd6c7

SHA512
9f64d7d0348e6b4cd954265c4c2a0c89ca2be1890968e670db636429ce18456a6d9995e297ef852aad934b360da971fe6af9570dce62c58acd28d96d9c8f5476

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads