flubot | 33666b5f83d4fb29d783beef08d710f0a2ed6e896adcad2c40b1ce3e33905e15

Analysis

max time kernel
149s
max time network
159s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
31-08-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b62a449bdeff05e4bf7b6e42870ed4ad8d3f9a6cef66267b05295d8937e0b10.apk
Size

4.6MB
MD5

452cc39649bfdfdd81de938f2ce93481
SHA1

b499554198e09fd171bbdd8d1cd3a0711c2a6bbd
SHA256

5b62a449bdeff05e4bf7b6e42870ed4ad8d3f9a6cef66267b05295d8937e0b10
SHA512

1750ae273a2c3b0000a2371e42c9fd3299f667c55d3fa6cf27c0b5154b498a65ed07ae3075dd645f34ca148777e9bea2dd95d936973fce4ca943a4aad999fe1e
SSDEEP

98304:hoNuiDQ9wfSVdDp6gDkTjhJfB5oxlAuEk0Olk0msIQpfYgQ+Q67D2w:hKr4pVZp6PjbfskXX+fPQd67/

Score

10^/10

flubot banker collection credential_access discovery evasion impact infostealer persistence trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

resource	yara_rule
behavioral3/memory/4632-0.dex	family_flubot

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.moxiu.launcher/ldGnhhYsGg/obxGmhfzaYjGYhs/base.apk.GfYhdhc1.bvf	4632	com.moxiu.launcher

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.moxiu.launcher

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.moxiu.launcher

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.moxiu.launcher

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.moxiu.launcher

com.moxiu.launcher
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.moxiu.launcher/ldGnhhYsGg/obxGmhfzaYjGYhs/base.apk.GfYhdhc1.bvf

Filesize
2.3MB

MD5
bccc264f54ba87ac50aadbdc9b6c1669

SHA1
a926c3ffab368d1f594f2169afa9317d3ba73e5a

SHA256
455d1801f96be1258b08a548b59ebf7d37d76cd96c05313e192779b1343d4853

SHA512
6e252ae6a0f5dbf11e18e1af778b426406dfe09c61b7ad638f783eb0805b3adeab75ad0e1458dfdc52fd0f73f17f8087604a5ff3ffa0e9f02cc8367b8fddc125

Download Submit
/data/user/0/com.moxiu.launcher/ldGnhhYsGg/obxGmhfzaYjGYhs/tmp-base.apk.GfYhdhc75430178648081601.bvf

Filesize
859KB

MD5
511d132e3fbf1e7fbdd84ab669df2c48

SHA1
16d5cd3d979b46b19561f43dd38c34863c9b92c9

SHA256
ee2dd0dad089d3dbf26f3076f2b15371796dac51d8c510746b3fd71525e954a2

SHA512
d04b2265542907f79fa3eedc9310e763a2c5b5c256c070390709d29a8acb1753bebe2d81cefa57613b9562dbbbc38469c58087689ab6e5a315a3dc2a8c00c0f8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads