flubot | 083cc87dcf5eba8916aa006b98008c0a7ad78a1d6e7f59e09a05ccfeb60abe4e | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
083cc87dcf5eba8916aa006b98008c0a7ad78a1d6e7f59e09a05ccfeb60abe4e.apk
Size 3.0MB
Sample210729-dk9834wxfe
SHA256 083cc87dcf5eba8916aa006b98008c0a7ad78a1d6e7f59e09a05ccfeb60abe4e
MD5 7f5d0f0a58dc2fb8712c468b647ed8a0
SHA1 508e4d293d5c66f72d0e41c9408c37a9db51bd01
SHA512 f90ec77a34c94a4fd8d18afa2ce48bcf66ea6d892732dca516d4b94ed6a410395b65b155cbf3e12a40f1a945be5cf738aaa5d6cb67159d349d58d6b4ee705f66
MD5 SHA1 SHA512

Score

10^/10

flubot android banker infostealer obfuscation ransomware trojan

Malware Config

Targets

- Target
  083cc87dcf5eba8916aa006b98008c0a7ad78a1d6e7f59e09a05ccfeb60abe4e.apk
- Size 3.0MB
- SHA256 083cc87dcf5eba8916aa006b98008c0a7ad78a1d6e7f59e09a05ccfeb60abe4e
- MD5 7f5d0f0a58dc2fb8712c468b647ed8a0
- SHA1 508e4d293d5c66f72d0e41c9408c37a9db51bd01
- SHA512 f90ec77a34c94a4fd8d18afa2ce48bcf66ea6d892732dca516d4b94ed6a410395b65b155cbf3e12a40f1a945be5cf738aaa5d6cb67159d349d58d6b4ee705f66
- MD5 SHA1 SHA512
Score

10^/10

flubot banker infostealer obfuscation ransomware trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot Payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Requests enabling of the accessibility settings.
- Reads name of network operator
  Uses Android APIs to discover system information.
- Uses Crypto APIs (Might try to encrypt user data).
  ransomware
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

flubotbankerinfostealerobfuscationransomwaretrojan