flubot | 446631292a2670814ea0110ab4942c7625627bc13fbd577d62fe4c100856de9b | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
446631292a2670814ea0110ab4942c7625627bc13fbd577d62fe4c100856de9b.apk
Size 3.7MB
Sample211124-nctctscecn
SHA256 446631292a2670814ea0110ab4942c7625627bc13fbd577d62fe4c100856de9b
MD5 6131504059fb7b5a155f70a4a11faa8a
SHA1 40304e030135d6118742de451c149f3bd009820e
SHA512 ec2eb236e26fc2603cfb18339177c4da5b804a3faa1f4dfc7ba90d89c9da3f6303a31dbd1ab89184419ebdd818bcc26d3191aa3809584582e4b6b13dada1f7e2
MD5 SHA1 SHA512

Score

10^/10

flubot android banker infostealer ransomware trojan

Malware Config

Targets

- Target
  446631292a2670814ea0110ab4942c7625627bc13fbd577d62fe4c100856de9b.apk
- Size 3.7MB
- SHA256 446631292a2670814ea0110ab4942c7625627bc13fbd577d62fe4c100856de9b
- MD5 6131504059fb7b5a155f70a4a11faa8a
- SHA1 40304e030135d6118742de451c149f3bd009820e
- SHA512 ec2eb236e26fc2603cfb18339177c4da5b804a3faa1f4dfc7ba90d89c9da3f6303a31dbd1ab89184419ebdd818bcc26d3191aa3809584582e4b6b13dada1f7e2
- MD5 SHA1 SHA512
Score

10^/10

flubot banker infostealer ransomware trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot Payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Uses Crypto APIs (Might try to encrypt user data).
  ransomware
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

flubotbankerinfostealerransomwaretrojan