flubot | 446c6ef506cdc21f0c207f5de701fe1170bf4b2f2a7874c9d957b41702ea398d | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DHLx25.apk
Size 4.5MB
Sample211202-mwpy3sabc5
SHA256 446c6ef506cdc21f0c207f5de701fe1170bf4b2f2a7874c9d957b41702ea398d
MD5 6c0c1ee3e7975428e7c1423275598148
SHA1 7c0d4db1a811ac5b309862096fd83369488f479c
SHA512 4a7a71d2fd2b2ee916219a1575526de5a2e3c1c2d5bc1142799fd633cb74e6310e5836a68ad11744e3b4e29740fe0f41c650f2e8e64053c21f76c21a4e752d0c
MD5 SHA1 SHA512

Score

10^/10

flubot android banker infostealer ransomware trojan

Malware Config

Targets

- Target
  DHLx25.apk
- Size 4.5MB
- SHA256 446c6ef506cdc21f0c207f5de701fe1170bf4b2f2a7874c9d957b41702ea398d
- MD5 6c0c1ee3e7975428e7c1423275598148
- SHA1 7c0d4db1a811ac5b309862096fd83369488f479c
- SHA512 4a7a71d2fd2b2ee916219a1575526de5a2e3c1c2d5bc1142799fd633cb74e6310e5836a68ad11744e3b4e29740fe0f41c650f2e8e64053c21f76c21a4e752d0c
- MD5 SHA1 SHA512
Score

10^/10

flubot banker infostealer ransomware trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot Payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Uses Crypto APIs (Might try to encrypt user data).
  ransomware
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

flubotbankerinfostealerransomwaretrojan