FluBot Malware Analysis Report TLP:WHITE FluBot - Malware Analysis Report Contents 1 Introduction 3 1.1 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2 Technical Analysis 5 2.1 com.tencent.mm - FluBot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 2.2 com.tencent.mm - Packer and String Obfuscation . . . . . . . . . . . . . . . . . . 6 2.3 com.tencent.mm - Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 2.4 com.tencent.mm - SMS Spam . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.5 com.tencent.mm - DGA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.6 com.tencent.mm - Accessibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 2.7 Command and Control Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 2.8 Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 3 Conclusion 22 4 IOC 23 DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 2 / 25 TLP:WHITE FluBot - Malware Analysis Report 1 Introduction Report Reference Number PRO-2021030506 Prepared by Ahmet Bilal CAN Approved by Ege BALCI Analysis Date 10.11.2020 Report Date 05.03.2021 In this report, we present a new Android banking malware that has been discovered by our PTI team. We have dubbed the malware FluBot due to its lack of a prominent name in the malware sample also because its spread rate and infection vector resemble the common flu. At the time of this writing, FluBot is largely targeting Spain, but the malware sample contains textual content for targeting German-, Polish-, and English-speaking users. During the notification period with Spanish authorities, several other researchers also published analysis report with the name “Cabassous“ however no information about the C&C and victim statistics was available. The PTI team has identified the following Android application names used by the FluBot campaign : “Fedex,” “DHL,” “Correos,” and “Chrome.” The PTI team has deanonymized the C&C server and discovered that FluBot has already infected more than 60,000 victims and stolen over 11 million phone numbers. FluBot has all of the generic banking malware features such as overlay attack and SMS stealing for OTP, but the key differences are that it : • Encrypts the part of request sent to the C&C server using RSA • Uses the contact lists of victims for spreading over SMS phishing messages • Uses a domain generation algorithm (DGA) for determining the C&C server address • Uses multiple hacked legitimate web sites for hosting the malicious APK file • Does not have remote access capabilities (except socks proxy) similar to Cerberus/Alien or Medusa mobile banking malware 1.1 Scope Package Name com.tencent.mm MD5 1a2a4044cf18eed59e66c413db766145 SHA256 30937927e8891f8c0fd2c7b6be5fbc5a05011c34a7375e91aad384b82b9e6a67 DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 3 / 25 TLP:WHITE FluBot - Malware Analysis Report Executive Summary This report is based on findings obtained from the analysis made of FluBot malware. FluBot is a new Android banking malware that uses overlay attacks to perform webview-based application phishing. The malware mainly targets mobile banking and cryptocurrency applications but also gathers a wide range of user data from all installed applications on a given device. Upon installation, FluBot malware instantly starts tracking applications being launched on the device. Once it detects a target application launch, the malware starts an overlay attack. FluBot downloads the specially crafted login page of the opened target application from the C&C server. The downloaded webview phishing page is then laid over the target application. The user suspects nothing because this event happens almost instantaneously when the legitimate application is opened. Once the application credentials are entered into the overlayed phishing page, FluBot malware sends the credentials to the C&C server controlled by the attacker. The FluBot malware also has the following capabilities : • Listening notifications • Reading and writing SMS messages • Getting contact lists • Performing calls DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 4 / 25 TLP:WHITE FluBot - Malware Analysis Report 2 Technical Analysis The PTI team was able to identify following four different FluBot package names : “com.tencent.mm,” “com.tencent.mobileqq,” “com.clubbing.photos,” and “com.redtube.music.” The report includes the technical details of all findings obtained within the scope of our malware analysis, itself based on the application with the package name “com.tencent.mm.” 2.1 com.tencent.mm - FluBot The application with the package name “com.tencent.mm” requires the following permissions. Permission List android.permission.WAKE_LOCK android.permission.QUERY_ALL_PACKAGES android.permission.CALL_PHONE android.permission.READ_CONTACTS android.permission.WRITE_SMS android.permission.RECEIVE_BOOT_COMPLETED android.permission.RECEIVE_SMS android.permission.FOREGROUND_SERVICE android.permission.SEND_SMS android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS android.permission.NFC android.permission.REQUEST_DELETE_PACKAGES android.permission.READ_PHONE_STATE android.permission.READ_SMS android.permission.INTERNET android.permission.BIND_NOTIFICATION_LISTENER_SERVICE android.permission.BIND_ACCESSIBILITY_SERVICE With the above permissions, the malware in question is able to perform the following actions : • Internet access • Reading/Sending SMS • Reading the phone book • Performing Calls • Deleting an application • Ability to use Accessibility service • Reading notifications DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 5 / 25 TLP:WHITE FluBot - Malware Analysis Report 2.2 com.tencent.mm - Packer and String Obfuscation FluBot uses a common Android malware packer that loads the decrypted DEX in runtime. Without any hooks, analysts can access the dropped DEX in the ‘app_DynamicOptDex‘ folder. Only string obfuscation is present in the decrypted DEX. Most of the samples have the following list of classes in the decrypted payload. • Bot • BotId • BrowserActivity • CardActivity • ComposeSmsActivity • ContactItem • DGA • ForegroundService • HttpCom • IntentStarter • LangTxt • MainActivity • MyAccessibilityService • MyNotificationListener • PanelReq • SmsReceiver • Spammer • Utils • SocksClient • PanelReq 2.3 com.tencent.mm - Commands The following table contains the list of available FluBot commands received from the C&C server. Command Description BLOCK Block any notification UNINSTALL_APP Uninstall the given application via packagename SEND_SMS Send given text to given phone number RUN_USSD Running ussd code. SMS_INT_TOGGLE Toggle interception sms CARD_BLOCK Popup the credit card phishing page DISABLE_PLAY_PROTECT Disable play protect via accessibility OPEN_URL Open the given url via webview GET_CONTACTS Send contact list to server. Later its used for spamming RETRY_INJECT Retry inject to already phished application RELOAD_INJECTS Resend package list to server. SOCKS Open sockets to let the attacker connect DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 6 / 25 TLP:WHITE FluBot - Malware Analysis Report The commands that the malware sends to the server are given in the table below. Command Description PING Ping the server to retrieve commands LOG Respond request to most of the commands. SMS,CONTACT,INTERCEPTING etc. SMS_RATE Get the seconds to send ‘GET_SMS‘ command GET_SMS Get the phishing SMS text including phone number. GET_INJECT Get phishing page for given packagename GET_INJECTS_LIST Get the list of targeted applications by sending all package names. The following image is an example of the overlay phishing content that FluBot uses for the targeted app. Figure 1.Webview Overlay Example Other than targeted apps, FluBot can trigger on-demand credit card phishing if it gets the “CARD_BLOCK” command from the server. The relevant image is given in Figure 2. DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 7 / 25 TLP:WHITE FluBot - Malware Analysis Report Figure 2. Credit Card Phishing FluBot blocks all incoming notifications when the BLOCK command is received from the server. The relevant code snippet is given in Figure 3. Figure 3. Notification removal code FluBot malware is able make USSD calls to the codes sent from the C&C server. The related code snippet is given in Figure 4. DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 8 / 25 TLP:WHITE FluBot - Malware Analysis Report Figure 4. Code allows running USSD code 2.4 com.tencent.mm - SMS Spam FluBot is also able to set itself as the default SMS application by abusing accessibility permissions, thus allowing the malware to send SMS messages on demand. The related code snippet is given in Figure 5. Figure 5. SMS Auto Accept With Accessibility Once it has infected the victim’s device, FluBot sends all phonebook (contact list) numbers to the C&C server. The related code snippet is given in Figure 6. Figure 6. Upload contact list to server The PTI team was able to observe the spreading behavior of the FluBot malware by analyzing the C&C communication of an infected device. The FluBot C&C panel sends the DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 9 / 25 TLP:WHITE FluBot - Malware Analysis Report stolen phonebook (contact list) numbers and SMS text message contents to infected devices to send more phishing SMS messages. The spreading behavior of the FluBot malware is very calculated. Instead of sending messages to every number from every infected device (flooding), it uses an SMS load distribution mechanism. The related code snippet is given in Figure 7. Figure 7. Sending SMS functionality Sample sms messages from the server are given in the image below, Figure 8. DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 10 / 25 TLP:WHITE FluBot - Malware Analysis Report Figure 8. Sample targeted number and SMS text message Analyst Note : Taking a closer look at the links in SMS phishing messages reveals that the threat actors are using different hacked web application servers in almost every message. This shows the FluBot operation’s level of sophistication, which distinguishes it from other consumer-grade banking malware. Following the links inside the SMS phishing messages takes the victims to a legitimate website hacked by the threat actors. Hacked web application servers are configured to contain the malicious APK file to requests with Android User-Agent. At the time of the PTI team’s investigation, attackers were using FedEx-themed campaigns. A sample phishing page is given in Figure 9 below. Figure 9. Fedex Campaign DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 11 / 25 TLP:WHITE FluBot - Malware Analysis Report 2.5 com.tencent.mm - DGA FluBot uses a domain generation algorithm (DGA) to obtain the address of the C&C server. The DGA creates 2000 domains according to the current year and month. Domains consist of 15 characters with “com,” “ru,” and “cn” TLDs. The relevant DGA code is given in Figure 10. Figure 10. DGA Seed Generation Code Figure 11. DGA Generate Domain Analyst Note : You can access the DGA decoder Python code that generates active command and control server domains from the following link : https://github.com/prodaft/malware-ioc/blob/master/FluBot/dga_gen.py The malware encrypts the part of request it sends to the server with the public RSA key. The relevant code snippet is given in Figure 12. Figure 12. RSA Encryption DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 12 / 25 TLP:WHITE FluBot - Malware Analysis Report The malware passes the responses from the server through the decryption routine as seen in Figure 13. Figure 13. Decryption of incoming request body FluBot sends encrypted message to domains generated from DGA. It checks whether if the decrypted text contains the BotId value sent in the initial request. Following flow chart briefly describes FluBot’s C&C validation routine. 14. Figure 14. Flow chart for validation Analyst Note : Because of this design FluBot is immune to traditional sinkhole approaches. The sample request sent to the malware command and control server is given in the image below, Figure 15. DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 13 / 25 TLP:WHITE FluBot - Malware Analysis Report Figure 15. Request Example Analyst Note : You can find frida script that is able to decrypt the requests and responses sent by the malware. https://github.com/prodaft/malware-ioc/blob/master/FluBot/getreq.js 2.6 com.tencent.mm - Accessibility Once the malware is initiated on the victim’s device, it requests activation of the service named ”AccessibilityService” from the accessibility settings. The relevant permission request message is shown in Figure 16. DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 14 / 25 TLP:WHITE FluBot - Malware Analysis Report Figure 16. Accessibility Popup Analyst Note : Normally, when the button in the confirmation popup is pressed immediately, the application shows an error message saying “Please read the message.” When same button is pressed after waiting for approximately 3-4 seconds, it directs the user to the accessibility settings. Malware uses accessibility to perform different activities such as the overlay attack. If the targeted package name exists in the triggered event, FluBot takes the texts on the screen, starts the BrowserActivity, and creates an overlay with the help of accessibility. The related code snippet is given in Figure 17. DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 15 / 25 TLP:WHITE FluBot - Malware Analysis Report Figure 17. Overlay Code In Figure 18 below is given in the screen view column where the texts of the target application screen are received and sent to the server. Figure 18. Accesibility Logger With Accessibility, FluBot is able to deactivate the Play Protect automatically. The related code snippet is given in Figure 19. Figure 19. Disable Play Protect FluBot also prevents the user from deleting itself by abusing the accessibility permission. The related code snippet is given in Figure 20. Figure 20. Prevent Uninstallation of Malware DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 16 / 25 TLP:WHITE FluBot - Malware Analysis Report FluBot automatically approves the permissions it requests with accessibility. The related code snippet is given in Figure 21. Figure 21. Auto accept permissions The malware automatically obtains “ignore battery optimizations” rights via accessibility. The related code snippet is given in Figure 22. Figure 22. Get Ignore Battery Optimizations rights Analyst Note : Generally, Android banking malware has two main ways of running in the background without being visible to the user. The first way is to avoid having to start itself as a foreground service by obtaining the “ignore battery optimizations” permission. The second way is to start itself as a foreground service and delete notifications from the notification bar with the help of the notification listener. FluBot opts for the first of these methods. DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 17 / 25 TLP:WHITE FluBot - Malware Analysis Report 2.7 Command and Control Panel At the time of analysis, the domain generation algorithm of the FluBot was dissected and active C&C servers were identified by the PTI team. The root directory of the C&C server contains a message from the threat actor intended for the analysts. Message contains the text “Добро пожаловать, пиздюки-разведчики. Вам всего доброго, хорошего настроения и здоровья” and a video of Dmitry Medvedev. Figure 23. Command and Control Panel Greeting Message Our threat intelligence team was able to analyze the C&C panel by deanonymizing the FluBot servers. The botnet panel is designed as a rudimentary PHP management dashboard with little to no detail. Despite its simplistic view, the control panel was able to handle around 60,000 infected device connections without any performance issues. DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 18 / 25 TLP:WHITE FluBot - Malware Analysis Report Figure 24. Command and Control Panel Dashboard The C&C panel contains the tabs “Bots,” “Stats,” “Commands,” “Inject List,” “All Logs,” and “Inject Logs.” The threat actor is able to manage every infected device with the following list of commands in the commands tab. • GET_CONTACTS • SMS_INT_TOGGLE • RETRY_INJECT • RELOAD_INJECTS • DISABLE_PLAY_PROTECT • SEND_SMS • SOCKS • RUN_USSD • UNINSTALL_APP • CARD_BLOCK • BLOCK • UPLOAD_SMS DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 19 / 25 TLP:WHITE FluBot - Malware Analysis Report Figure 25. Command and Control Panel Command Page DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 20 / 25 TLP:WHITE FluBot - Malware Analysis Report 2.8 Statistics The C&C panel also contains detailed statistics of the infected victims. At the time of analysis, FluBot had already infected more than 60,000 devices. Over 97% of the victims seemed to be based in Spain. Total number of collected phone numbers appears to be more than 11 million as of writing this report. Figure 26. Victims Statistics Page The statistics page of the panel also contains details about the device manufacturers, Android version, device language, and telecommunication operator name. When FluBot successfully obtains the banking credentials, they are sent to the C&C and stored with the following Figure 27 log format. Figure 27. Victims Statistics Page Each log entry for the infected device may contain the SMS messages, banking credentials, device contacts, and application webview text logs, all of which can be used for extracting any kind of text-based credentials from every application that uses webview panes. DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 21 / 25 TLP:WHITE FluBot - Malware Analysis Report 3 Conclusion The number of mobile banking malware types has been increasing significantly over the past five years. FluBot sets a new precedent of spreading methods and DGA implementations. During a very short timeframe, FluBot is able to infect more than 60,000 mobile phones. Currently there are more than 11 million phone numbers collected from the infected devices which represents 25% of the total population in Spain. We estimate that the malware is cabaple to collect almost all phone numbers in Spain within 6 months time if no action is taken. In other malware families, the SMS spreading functionality tends not to work as effectively. However, the SMS spreading functionality of FluBot (Smishing module) is well implemented and works in nearly all setups. In addition to the spreading method, its novel DGA approach makes it almost impossible to sinkhole the threat with traditional techniques. It should also be noted that FluBot can easily be adapted to spread to different countries with a simple configuration change in its codebase. Our PTI team monitors all known and as-yet-unknown APT groups daily. FluBot is not associated with any known groups as of writing this report. DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 22 / 25 TLP:WHITE FluBot - Malware Analysis Report 4 IOC Package Name Sha256 com.tencent.mm 30937927e8891f8c0fd2c7b6be5fbc5a05011c34a7375e91aad384b82b9e6a67 com.tencent.mobileqq 1eb54ee1328ad5563e0e85a8ecff13cd2e642f5c6fc42e0e1038aeac0ee8cf2f com.clubbing.photos 2277d20669267bbe9ff8a656258af0a33563c18c45cef3624eab67cf123c29a7 com.redtube.music 3bb0dbdb9ec7822dc53af230de0bdb908a558993619ac788c90eeeb5af6a1e14 Active C&C Server Domains(for March 2021) : • xjnwqdospderqtk.ru • nfiuerwtftasnuk.com APK Distribution Domains : • http://2020.techbharat.org.in/status/ • http://amirapache.ir/pkg/ • http://anapa-dive.ru/pkge/ • http://audioquran.kz/www/ • http://Boutique.creolegarden.com/fedex/ • http://buguilou.com/p/ • http://canhair.net/parcel/ • http://cloudstrading.com/fedex/ • http://developer.team1global.com.au/pack/ • http://ekremakin.org/pack/ • http://elektroprommash.ru/pack/ • http://freeavporn.com/fedex/ • http://grahaksamachar.in/p/ • http://idea-soft.it/p/ • http://imw6.com/pack/ • http://imwedsonpassos.com.br/parcel/ • http://isabelsantos123.pt/p/ • http://itaperunatem.com.br/pkge/ • http://lamoraleja.com.co/status/ • http://landing.kofacins.com/pack/ • http://ln-lighting.com/pkg/ • http://mimi-mi.studio/pkg/ • http://muaadzawy.com/pkg/ • http://ouyangpengcheng.xyz/p/ • http://palinkapatika.com/pack/ • http://pescadorsportsgroup.com/pkg/ • http://portalcalamuchita.com.ar/pack/ • http://printing-packingshow.ir/fedex/ • http://raku-plus.com/pack/ • http://rpgbundle.info/status/ • http://sailorcrossfitmdp.com/fedex/ • http://skipshopping.net/fedex/ • http://srinterior.co.in/pkg/ DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 23 / 25 TLP:WHITE FluBot - Malware Analysis Report • http://studiobonazzi.eu/fedex/ • http://telec.com.pk/pkg/ • http://teologianaweb.com.br/pkg/ • http://thejoblessemperor.in/pkg/ • http://valks3d.com.br/fedex/ • http://videoeditorhub.com/pkg/ • http://www.export-barazande.com/fedex/ • http://www.internetpathshala.co/p/ • http://www.larrecantofeliz.com.br/fedex/ • http://www.old.danacadesign.com/fedex/ • http://www.payamesavadkooh.ir/pack/ • http://www.pudhuveedu.in/p/ • http://www.raeloficial.com/pkg/ • http://www.recycom.gr/pack/ • http://www.zyzlk.com/p/ • http://www.zyzlk.com/pack/ • http://wxz14.com/p/ • http://xref.icu:9090/pkg/ • http://yangbin.100cuo.com/pack/ • http://yulu1953.cn/fedex/ • https://42sf.net/pack/ • https://84blog.xyz/pkg/ • https://aitao.site/pkg/ • https://alercehistorico.cl/pkg/ • https://amzstudy.com/pack/ • https://apartners.vn/pack/ • https://brighterdaysfi.com/fedex/ • https://byalex-photography.co.uk/pack/ • https://cbd-and-epilepsy.com/pack/ • https://cbd-and-seizures.com/p/ • https://contornosdesign.pt/pkg/ • https://cssincronbucuresti.ro/pkg/ • https://delhi.tie.org/p/ • https://dgeneration.in/pack/ • https://dumeiwu.com/p/ • https://elitekidsbookzone.sch.ng/pack/ • https://escuelaargentina.cl/p/ • https://fraternitykerala.org/pkg/ • https://garveylibertyhall.com/pack/ • https://getblogour.com/fedex/ • https://gladiadoresdevendas.com.br/pack/ • https://hentaivillage.com/parcel/ • https://illuminaticult.org/fedex/ • https://imrt.ac.in/pack/ • https://imrt.ac.in/pkg/ • https://industrial-land.vn/pack/ • https://jexchange.ga/pack/ DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 24 / 25 TLP:WHITE FluBot - Malware Analysis Report • https://kidimy.org/pkg/ • https://lacasa-dh.nl/pack/ • https://londonroofingpros.co.uk/fedex/ • https://machupicchutraveling.com/pkg/ • https://mucc.com.au/p/ • https://mvpmsadhyapak.in/p/ • https://nakoblog.info/fedex/ • https://nen.vacad.net/pkg/ • https://pic.tnell.com/pkg/ • https://rishipes.co.nz/pack/ • https://ryansa.com/pkg/ • https://sdlformazione.it/p/ • https://sprintintercom.com.au/fedex/ • https://telugufusion.com/pkg/ • https://tuyennvtb.com/p/ • https://twospoonsfleet.co.uk/p/ • https://visotka.in/pack/ • https://weboyal.com/p/ • https://www.admh.in/fedex/ • https://www.agroescape.com/pkg/ • https://www.divam.ir/pack/ • https://www.nbkangxi.com/pack/ • https://www.omvshop.com/pkge/ • https://www.spave.com.pk/p/ • https://www.wwworks.com.au/p/ • https://www.ylem222.com/p/ • https://xatziemmanouiltools.gr/pkg/ • https://xn–thvitstore-c7a.com/pkg/ DISCLAIMER : This document, as well as the information contained herein, shall be deemed as proprietary and privileged information of PRODAFT and shall be subjected to articles and provisions that have been stipulated in General Data Protection Regulations and Law on Protection of Personal Data numbered 6698. It shall be noted that PRODAFT provides this information in an “as is” manner according to its findings, without providing any legally applicable warranty about completeness or accuracy of the content. Therefore, this report or any of its contents cannot be used as admissible proof before legal authorities. 25 / 25 1 Introduction 1.1 Scope Executive Summary 2 Technical Analysis 2.1 com.tencent.mm - FluBot 2.2 com.tencent.mm - Packer and String Obfuscation 2.3 com.tencent.mm - Commands 2.4 com.tencent.mm - SMS Spam 2.5 com.tencent.mm - DGA 2.6 com.tencent.mm - Accessibility 2.7 Command and Control Panel 2.8 Statistics 3 Conclusion 4 IOC