flubot | 2e6fc58f22d79504a3b29a58283a846371606da5f220a69abdb92a5e3a9667f6 | Triage

Resubmissions

11-06-2021 16:49

210611-9azca2rk72 8

11-06-2021 13:02

210611-xstgpe6j72 8

13-05-2021 11:41

210513-ca8exx1m7e 10

13-05-2021 11:33

210513-bf5j79np5n 7

Analysis

max time kernel
1703589s
max time network
165s
platform
android_x64
resource
android-x64
submitted
13-05-2021 11:41

Sharing

Report Analysis Logs

General

Target

bd005c1854ffb4f56ec4524825f49a61.apk
Size

6.6MB
MD5

bd005c1854ffb4f56ec4524825f49a61
SHA1

cd02b2185af2e8785e2c506ee21e7b8a73a39f02
SHA256

2e6fc58f22d79504a3b29a58283a846371606da5f220a69abdb92a5e3a9667f6
SHA512

8fff9d70f15d94c4575e67dd0d7484f1a7c4d8cfdc997d23b3958510a33c8732ea09f6921c86101d8189c7ccabe203a74022946ba887d80e926474780eab0f0e

Score

10^/10

flubot banker infostealer trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 1 IoCs

resource	yara_rule
behavioral1/files/3651-0.dat	family_flubot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.tencent.mobileqq/app_DynamicOptDex/tWo.json	3651	com.tencent.mobileqq
/data/user/0/com.tencent.mobileqq/app_DynamicOptDex/tWo.json	3651	com.tencent.mobileqq

com.tencent.mobileqq
1⤵
- Loads dropped Dex/Jar
PID:3651

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads