flubot | 0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23.apk
Size 3.0MB
Sample210719-9kbgb2pgae
SHA256 0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23
MD5 75c0eb2c78ff31534a588ec47088b622
SHA1 abc703f6e5b824d0a1c14108228009001509a162
SHA512 d0b74f972f851fc7a1f715e152e6f439a080b4d7b1f3129cec6c3164d8b1f75c34a920c393d5d05be45185a2b926b6c382b5e83387436b7905b2500e3db4c36b
MD5 SHA1 SHA512

Score

10^/10

flubot android banker infostealer obfuscation ransomware trojan

Malware Config

Targets

- Target
  0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23.apk
- Size 3.0MB
- SHA256 0de7ded6e4db0cb540ef7249c4bb96ca3147aa193801b06c5235781271bc4b23
- MD5 75c0eb2c78ff31534a588ec47088b622
- SHA1 abc703f6e5b824d0a1c14108228009001509a162
- SHA512 d0b74f972f851fc7a1f715e152e6f439a080b4d7b1f3129cec6c3164d8b1f75c34a920c393d5d05be45185a2b926b6c382b5e83387436b7905b2500e3db4c36b
- MD5 SHA1 SHA512
Score

10^/10

flubot banker infostealer obfuscation ransomware trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot Payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Requests enabling of the accessibility settings.
- Reads name of network operator
  Uses Android APIs to discover system information.
- Uses Crypto APIs (Might try to encrypt user data).
  ransomware
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

flubotbankerinfostealerobfuscationransomwaretrojan