flubot | 4a49972ed962b5326b9edcb9edbfeef47d3a216cf5847d579eb0c69a3ed6b9be | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
4a49972ed962b5326b9edcb9edbfeef47d3a216cf5847d579eb0c69a3ed6b9be.apk
Size 4.9MB
Sample211220-pnhadaaee4
SHA256 4a49972ed962b5326b9edcb9edbfeef47d3a216cf5847d579eb0c69a3ed6b9be
MD5 cf24c8590d4fa7d8bf3a0872b98ae647
SHA1 911b4bfdc4d3a99096d375cedfc5e29520580389
SHA512 dada00f02754a645c583b52a7fcacd9d6198f8703d9d3470f3680d77f6dec14973fac47a47f99de75ffb4a4b79c6d7d67ac366d2b0fb15e476d609914fb44b09
MD5 SHA1 SHA512

Score

10^/10

flubot android banker infostealer ransomware trojan

Malware Config

Targets

- Target
  4a49972ed962b5326b9edcb9edbfeef47d3a216cf5847d579eb0c69a3ed6b9be.apk
- Size 4.9MB
- SHA256 4a49972ed962b5326b9edcb9edbfeef47d3a216cf5847d579eb0c69a3ed6b9be
- MD5 cf24c8590d4fa7d8bf3a0872b98ae647
- SHA1 911b4bfdc4d3a99096d375cedfc5e29520580389
- SHA512 dada00f02754a645c583b52a7fcacd9d6198f8703d9d3470f3680d77f6dec14973fac47a47f99de75ffb4a4b79c6d7d67ac366d2b0fb15e476d609914fb44b09
- MD5 SHA1 SHA512
Score

10^/10

flubot banker infostealer ransomware trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot Payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Uses Crypto APIs (Might try to encrypt user data).
  ransomware
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

flubotbankerinfostealerransomwaretrojan