flubot | 34d3338408dfd8244ba7ee655f558f0e06e0982cb76584f88707f6d0bdcf6a2c | Triage™

Resubmissions

13/09/2021, 09:21

210913-lblv9ageap10

11/09/2021, 11:26

210911-njvt8sbcg88

Analysis

max time kernel
3732435s
max time network
49s
platform
android_x64
resource
android-x64
submitted
13/09/2021, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL98.apk
Size 2.6MB
Sample210913-lblv9ageap
SHA256 34d3338408dfd8244ba7ee655f558f0e06e0982cb76584f88707f6d0bdcf6a2c
MD5 6a7e746ade78143f4ca2a7a4ce33f250
SHA1 452abfbc77dc37780b571d0ce4f623ac960d89ff
SHA512 d4a82b20a5acf601e36b2c1abcdc1a6275a6baca43746e4a7f525368f1db5e699369efe1c0656172f962b44bb4c2f421bf526d0466e24f094af623e10d546245
MD5 SHA1 SHA512

Score

10^/10

flubot banker infostealer obfuscation trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3646-0.dex	family_flubot

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.dailyyoga.cn/code_cache/secondary-dexes/base.apk.classes1.zip	3646	com.dailyyoga.cn

Uses reflection 1 IoCs

description	pid	Process
Invokes method android.view.ViewGroup.makeOptionalFitsSystemWindows	3646	com.dailyyoga.cn

com.dailyyoga.cn
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:3646

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads