flubot | 28fae6aca664c27bb6c50c3e31a8725a5b8b7580437630e469200fa762c49578

Analysis

max time kernel
179s
max time network
189s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
05-08-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28fae6aca664c27bb6c50c3e31a8725a5b8b7580437630e469200fa762c49578.apk
Size

3.5MB
MD5

b4dc0d1e58ee37e5f39e8c2ed4c42784
SHA1

94a40550d66cf6dc2571d1624890a60c043136fa
SHA256

28fae6aca664c27bb6c50c3e31a8725a5b8b7580437630e469200fa762c49578
SHA512

ed8bcbb81f7f13046196de2e5d6c3449bb0e57af56bbca5d5cf9cff0599c3014666fac437964996bf6dc5ce7f5f745d9ba60ac7482e4676d8a891b37c9911d9f
SSDEEP

98304:RF8b/CPD8mNot1oUKONt6XMR7UzKBbhAsKaNG3eDQ:kb/C71otFKOqKhcp

Score

10^/10

flubot banker collection credential_access discovery evasion impact infostealer persistence trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

Processes:

resource	yara_rule
/data/data/com.dytake.downloader/app_ded/UoieE2CowFJY21HaLt1jIQufe5bOF7Oj.dex	family_flubot

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.dytake.downloader

ioc	pid	process
/data/user/0/com.dytake.downloader/app_apkprotector_dex/classes-v1.bin	4973	com.dytake.downloader
/data/user/0/com.dytake.downloader/app_apkprotector_dex/classes-v1.bin	4973	com.dytake.downloader
/data/user/0/com.dytake.downloader/app_ded/UoieE2CowFJY21HaLt1jIQufe5bOF7Oj.dex	4973	com.dytake.downloader
/data/user/0/com.dytake.downloader/app_ded/UoieE2CowFJY21HaLt1jIQufe5bOF7Oj.dex	4973	com.dytake.downloader

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.dytake.downloader

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.dytake.downloader
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.dytake.downloader
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.dytake.downloader

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.dytake.downloader

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.dytake.downloader

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.dytake.downloader

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.dytake.downloader

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.dytake.downloader
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.dytake.downloader

Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.dytake.downloader

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dytake.downloader
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.dytake.downloader

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.dytake.downloader

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dytake.downloader

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.dytake.downloader

com.dytake.downloader
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4973

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dytake.downloader/app_apkprotector_dex/classes-v1.bin

Filesize
120KB

MD5
c384c5cdaf8f3edfa29389f2de2effea

SHA1
5e5dad9692cf5794e3ff7b99a64e6555399bc56f

SHA256
0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

SHA512
7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

Download Submit
/data/data/com.dytake.downloader/app_ded/UoieE2CowFJY21HaLt1jIQufe5bOF7Oj.dex

Filesize
2.2MB

MD5
8bad77a96467be614a75af30e637025b

SHA1
cb30f4f45f9d7f6a72e023206c1cc1504cc81538

SHA256
9d5d4f3a94a78f93cb3e418d89226cfc6088d31da44193f7665dbd1f266a645a

SHA512
4d3e44302d758f49e3c6377834af48d8c667626a6ac98908fb9005fa9a64cbe083358d0be1a80e0766fceb950c38fe76b25b0bfb09b33d8e5d9ff7fe66bb4a6b

Download Submit