flubot | 289d589b3de665464190264d55d1943eaac7a5bedbd0cdf934bf7ea5b0041e26

General

Target

28c11bb998bf8c023a212c6518b4f8219c8583c2e79fc87d76be6fcad51b522f.apk
Size

4.9MB
MD5

92891906b5842b1daac01661731116b9
SHA1

53ff2b0a928fda3439d188c9b7d2f989f7e93eec
SHA256

28c11bb998bf8c023a212c6518b4f8219c8583c2e79fc87d76be6fcad51b522f
SHA512

0b5f95a0c2022953c8ccf65808c976ea54718495952a115d557098443dc7509d419fe2c5255f05795a057061cf64bf69479c349a8361e7f4950325dc7344feb0
SSDEEP

98304:Ctbtx8eId6BxzYR3veFk1lW1zdMQ0pDDDxjUXIklfie3RrQm+jVNryVIh:Cxq8bzYR3WFk1lW1zdMPxDDxI4kXV+xF

Score

10^/10

flubot banker collection credential_access defense_evasion discovery evasion impact infostealer persistence trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-2.dat	family_flubot

Flubot family
flubot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json	5097	extend.dress.since
/data/user/0/extend.dress.since/app_DynamicOptDex/BeJsupe.json	5097	extend.dress.since

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	extend.dress.since
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	extend.dress.since
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	extend.dress.since

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	extend.dress.since

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	extend.dress.since
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	extend.dress.since

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	extend.dress.since

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	extend.dress.since

extend.dress.since
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:5097

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

1

T1541

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/extend.dress.since/app_DynamicOptDex/BeJsupe.json

Filesize
1.5MB

MD5
e2993d2a3cd519c197e808c18750fd07

SHA1
22d1cc1b7db89f1dfc1892a954778399ac903005

SHA256
7cfd37d111f15e729ad5d9bd8c831771e2157d68808e51ec2470437087636c73

SHA512
7ea089e7169b574e8d8ff524d0f9742f1eee6e901a2dc9fb92d3160b517db46cebe7b4549ab250426560d27227eba57780e0cd3bdae63b3e3dc5070f5ae6ac0f

Download Submit
/data/data/extend.dress.since/app_DynamicOptDex/BeJsupe.json

Filesize
1.5MB

MD5
40bc23344a0f46f04cf0533ae12c86b4

SHA1
4330aa71cc6bce9eac084368d207f1aeeabbec50

SHA256
e89d9804064dfff2a9890e595825a3074f88ffcbfe7c21800a9464d2aa9ab832

SHA512
e2e32639b3080412ee5a4f898c7ed8f422e854bd8e759402d21eb2620333a60170f80e21998dbe3e2ec652a3c7dc1ff8528c52d5df7a95a35046811b752d4f45

Download Submit
/data/data/extend.dress.since/app_DynamicOptDex/oat/BeJsupe.json.cur.prof

Filesize
2KB

MD5
41c95903f7b8397f3de73f0422ea18d0

SHA1
04b9f3dc59dc2b97e2a639cb20e44338db11f696

SHA256
2f698ac6bd59d27d161e30ed263f094eb8694c7423945f37c66f595f10f864c4

SHA512
63356a395dd0f4101a5dfae12ad54ee7b0c61b88637c9a363813e969e3f66848ca26a3489a9bb076bdb1a31421ebb01ad5f3d4f97c7322bebee86afad1e14bae

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads