flubot | 7aad6cbd0fa4917a2ed320685faafda81407387d7bb6e13b7c2ed63b73e277e5 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
7aad6cbd0fa4917a2ed320685faafda81407387d7bb6e13b7c2ed63b73e277e5.apk
Size 3.0MB
Sample210720-2eexkced1e
SHA256 7aad6cbd0fa4917a2ed320685faafda81407387d7bb6e13b7c2ed63b73e277e5
MD5 26e3356e5cce25da705f8167504e0393
SHA1 d9fc9de53533fad0ca496e20fea5acd161718603
SHA512 64a2885cc44a1ba7f9f39a97ac187576d403afcbb741ee83fa2eebc457bd345aa5130138fb295171148429010307ba23cfd749e4193c8accbbfa29d808379f25
MD5 SHA1 SHA512

Score

10^/10

flubot android banker infostealer obfuscation ransomware trojan

Malware Config

Targets

- Target
  7aad6cbd0fa4917a2ed320685faafda81407387d7bb6e13b7c2ed63b73e277e5.apk
- Size 3.0MB
- SHA256 7aad6cbd0fa4917a2ed320685faafda81407387d7bb6e13b7c2ed63b73e277e5
- MD5 26e3356e5cce25da705f8167504e0393
- SHA1 d9fc9de53533fad0ca496e20fea5acd161718603
- SHA512 64a2885cc44a1ba7f9f39a97ac187576d403afcbb741ee83fa2eebc457bd345aa5130138fb295171148429010307ba23cfd749e4193c8accbbfa29d808379f25
- MD5 SHA1 SHA512
Score

10^/10

flubot banker infostealer obfuscation ransomware trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot Payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data).
  ransomware
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

flubotbankerinfostealerobfuscationransomwaretrojan