flubot | f86ce60828d2fe6601b3b8c005ed543873ad6769409fc70cd1ecbe5357626f5b

General

Target

f86ce60828d2fe6601b3b8c005ed543873ad6769409fc70cd1ecbe5357626f5b.apk
Size

4.1MB
MD5

4ee49e0bc3cde30139e9484d2ab73440
SHA1

7e67b11ef4820f8e70581b8c1d43c2b32063b297
SHA256

f86ce60828d2fe6601b3b8c005ed543873ad6769409fc70cd1ecbe5357626f5b
SHA512

954f6cc847e162b66131d90a0b44d9bd9aa5e1083a118bb707c8b6400342493e20e9c934ecbb7bb821a062b71fe61d8a8b1b66cb0bc702f69e236a70f7a44472
SSDEEP

98304:Dnc67bs9X7DFB2kNgRrQv0Ddnwyypk2Oxm96duI:Dnc6749XvOEqvuI

Score

10^/10

flubot banker collection credential_access discovery evasion impact infostealer persistence trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-2.dat	family_flubot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/floor.hen.will/app_DynamicOptDex/KkI.json	4980	floor.hen.will
/data/user/0/floor.hen.will/app_DynamicOptDex/KkI.json	4980	floor.hen.will

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	floor.hen.will
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	floor.hen.will
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	floor.hen.will

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	floor.hen.will

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	floor.hen.will
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	floor.hen.will

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	floor.hen.will

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	floor.hen.will

floor.hen.will
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

1

T1541

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/floor.hen.will/app_DynamicOptDex/KkI.json

Filesize
1.5MB

MD5
2d3ea038b6b12099d27ec3675655d55a

SHA1
71f94b12680be8fb627d7204218990800c279f60

SHA256
51c4ee71fa4eaaf63cc733a5a3307b78dddc3a8fc1585d8f01b0fe686295333a

SHA512
59944086e97658c6de405b6bd4beb355b4b7f8dc371cdc4982d19e140fd4495f9e2d63268839b329088cdef0c0015ce3c3ccce5ccd548e05c1aff4c9ef5987ae

Download Submit
/data/data/floor.hen.will/app_DynamicOptDex/KkI.json

Filesize
1.5MB

MD5
40bc23344a0f46f04cf0533ae12c86b4

SHA1
4330aa71cc6bce9eac084368d207f1aeeabbec50

SHA256
e89d9804064dfff2a9890e595825a3074f88ffcbfe7c21800a9464d2aa9ab832

SHA512
e2e32639b3080412ee5a4f898c7ed8f422e854bd8e759402d21eb2620333a60170f80e21998dbe3e2ec652a3c7dc1ff8528c52d5df7a95a35046811b752d4f45

Download Submit
/data/data/floor.hen.will/app_DynamicOptDex/oat/KkI.json.cur.prof

Filesize
2KB

MD5
5207010ecb0c4a825177cc99165e20e9

SHA1
f55490b4befa9c2177be07e37e7b6f21a4b3515f

SHA256
2c0dcc8430ddb9bc7c862df1f6ab22646ac88ac9183a76e69b75184a47dfe3ad

SHA512
65e7685678e93bd4f26be3a4217ab6c16a640e69eae43066b741921b3ba377d378f07c53233a5b82aac4115e13c31064cd859ef72a23eb9124195d3796cb3857

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads