flubot | b1e40e321456c2a9e6d06c4e79961d388cd55050c055f47cdd9e0a2db571916b | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DHL6.apk
Size 5.3MB
Sample211215-tpblfaaad3
SHA256 b1e40e321456c2a9e6d06c4e79961d388cd55050c055f47cdd9e0a2db571916b
MD5 84b312dd3572f4b60bbc57d4098e636e
SHA1 2daddbdc286ec36fd4b91c7c80614c96ddb61592
SHA512 0270989453f7eeaf1cab1db8e0e66c88d86da5455079081a758c3aaa600d8b73780a3494558200a1713b05bf9d4855b938b0a9ca442f30406bf13776688551f0
MD5 SHA1 SHA512

Score

10^/10

flubot android banker infostealer ransomware trojan

Malware Config

Targets

- Target
  DHL6.apk
- Size 5.3MB
- SHA256 b1e40e321456c2a9e6d06c4e79961d388cd55050c055f47cdd9e0a2db571916b
- MD5 84b312dd3572f4b60bbc57d4098e636e
- SHA1 2daddbdc286ec36fd4b91c7c80614c96ddb61592
- SHA512 0270989453f7eeaf1cab1db8e0e66c88d86da5455079081a758c3aaa600d8b73780a3494558200a1713b05bf9d4855b938b0a9ca442f30406bf13776688551f0
- MD5 SHA1 SHA512
Score

10^/10

flubot banker infostealer ransomware trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot Payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Reads information about phone network operator.
- Uses Crypto APIs (Might try to encrypt user data).
  ransomware
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

flubotbankerinfostealerransomwaretrojan