flubot | 338041fa9c4e537aedd399de211d3ed3f7ab862cc961c49692fa54d91505ce47 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
338041fa9c4e537aedd399de211d3ed3f7ab862cc961c49692fa54d91505ce47.apk
Size 3.8MB
Sample211005-s89rxaaae8
SHA256 338041fa9c4e537aedd399de211d3ed3f7ab862cc961c49692fa54d91505ce47
MD5 31257dedfa52e14dee4b708033bcad18
SHA1 8414fcc9774d5a4966aa250e0c63ca0122a465dd
SHA512 52e467baf86c69a316b83150052d0e5ff3b15c32d71f77a4a790de8f7b53343005083ec8ea6ca387a64cf18fdea29e0e86873ab0ba30345c7e812ff32291ba6a
MD5 SHA1 SHA512

Score

10^/10

flubot android banker infostealer obfuscation ransomware trojan

Malware Config

Targets

- Target
  338041fa9c4e537aedd399de211d3ed3f7ab862cc961c49692fa54d91505ce47.apk
- Size 3.8MB
- SHA256 338041fa9c4e537aedd399de211d3ed3f7ab862cc961c49692fa54d91505ce47
- MD5 31257dedfa52e14dee4b708033bcad18
- SHA1 8414fcc9774d5a4966aa250e0c63ca0122a465dd
- SHA512 52e467baf86c69a316b83150052d0e5ff3b15c32d71f77a4a790de8f7b53343005083ec8ea6ca387a64cf18fdea29e0e86873ab0ba30345c7e812ff32291ba6a
- MD5 SHA1 SHA512
Score

10^/10

flubot banker infostealer obfuscation ransomware trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot Payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Uses Crypto APIs (Might try to encrypt user data).
  ransomware
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

flubotbankerinfostealerobfuscationransomwaretrojan