Overview

overview

10

Static

static

7

51143dafcb...1b.apk

android_x86

10

51143dafcb...1b.apk

android_x64

10

51143dafcb...1b.apk

android_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    51143dafcb45ab864b0265c8752fe4b548687c409a3500d011e62b3c313c2b1b.apk

  • Size

    4.2MB

  • Sample

    220214-snfy4abahl

  • MD5

    9117b7d20ce3864e8ea24645346cdbc8

  • SHA1

    ac545f005905aa31d77ee1335cea7a0de68ba48e

  • SHA256

    51143dafcb45ab864b0265c8752fe4b548687c409a3500d011e62b3c313c2b1b

  • SHA512

    44dc3f722f448a77081a41705262ad6b50cd58ffbaff95af03a45b4ab05f7e3ddf7c6d36d10517b548b02c13e23c208caaae8bcdb28404864ffd0e9ad366914f

Score
10/10
flubotandroidbankerinfostealerransomwaretrojan

Malware Config

Targets

    • Target

      51143dafcb45ab864b0265c8752fe4b548687c409a3500d011e62b3c313c2b1b.apk

    • Size

      4.2MB

    • MD5

      9117b7d20ce3864e8ea24645346cdbc8

    • SHA1

      ac545f005905aa31d77ee1335cea7a0de68ba48e

    • SHA256

      51143dafcb45ab864b0265c8752fe4b548687c409a3500d011e62b3c313c2b1b

    • SHA512

      44dc3f722f448a77081a41705262ad6b50cd58ffbaff95af03a45b4ab05f7e3ddf7c6d36d10517b548b02c13e23c208caaae8bcdb28404864ffd0e9ad366914f

    Score
    10/10
    flubotbankerinfostealerransomwaretrojan

    • FluBot

      FluBot is an android banking trojan that uses overlays.

      bankertrojaninfostealerflubot

    • FluBot Payload

    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

      banker

    • Acquires the wake lock.

    • Checks Qemu related system properties.

      Checks for Android system properties related to Qemu for Emulator detection.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks