Overview

overview

10

Static

static

7

DHL6.apk

android_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL6.apk

  • Size

    5.3MB

  • Sample

    211215-tpblfaaad3

  • MD5

    84b312dd3572f4b60bbc57d4098e636e

  • SHA1

    2daddbdc286ec36fd4b91c7c80614c96ddb61592

  • SHA256

    b1e40e321456c2a9e6d06c4e79961d388cd55050c055f47cdd9e0a2db571916b

  • SHA512

    0270989453f7eeaf1cab1db8e0e66c88d86da5455079081a758c3aaa600d8b73780a3494558200a1713b05bf9d4855b938b0a9ca442f30406bf13776688551f0

Score
10/10
flubotandroidbankerinfostealerransomwaretrojan

Malware Config

Targets

    • Target

      DHL6.apk

    • Size

      5.3MB

    • MD5

      84b312dd3572f4b60bbc57d4098e636e

    • SHA1

      2daddbdc286ec36fd4b91c7c80614c96ddb61592

    • SHA256

      b1e40e321456c2a9e6d06c4e79961d388cd55050c055f47cdd9e0a2db571916b

    • SHA512

      0270989453f7eeaf1cab1db8e0e66c88d86da5455079081a758c3aaa600d8b73780a3494558200a1713b05bf9d4855b938b0a9ca442f30406bf13776688551f0

    Score
    10/10
    flubotbankerinfostealerransomwaretrojan

    • FluBot

      FluBot is an android banking trojan that uses overlays.

      bankertrojaninfostealerflubot

    • FluBot Payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1

MITRE ATT&CK Matrix

Tasks