Overview

overview

10

Static

static

7

Voicemail.apk

android_x86

10

Resubmissions

23-04-2022 16:27

220423-tyjy6sdcd4 10

13-04-2022 09:45

220413-lq3sbaahdj 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Voicemail.apk

  • Size

    4.5MB

  • Sample

    220423-tyjy6sdcd4

  • MD5

    3792143bdc6821a17b4a7691159e0d79

  • SHA1

    5f4afa4783c7bbf79dedd0a9b5bc44087b631fb7

  • SHA256

    a952704d730558072d8050e868640130e170f02f179eb39ea20696b6cd0ad0c5

  • SHA512

    9726db642251f85712ee9f822cfeffa23a81bc50e8cf0b60edebd9c86003e7a4c2b3733c8bd2ab836fcf46c9002e59ab4b2cb8295fe4a497c8a7c58985b68cbd

Score
10/10
flubotandroidbankerevasioninfostealerransomwaretrojan

Malware Config

Targets

    • Target

      Voicemail.apk

    • Size

      4.5MB

    • MD5

      3792143bdc6821a17b4a7691159e0d79

    • SHA1

      5f4afa4783c7bbf79dedd0a9b5bc44087b631fb7

    • SHA256

      a952704d730558072d8050e868640130e170f02f179eb39ea20696b6cd0ad0c5

    • SHA512

      9726db642251f85712ee9f822cfeffa23a81bc50e8cf0b60edebd9c86003e7a4c2b3733c8bd2ab836fcf46c9002e59ab4b2cb8295fe4a497c8a7c58985b68cbd

    Score
    10/10
    flubotbankerevasioninfostealerransomwaretrojan

    • FluBot

      FluBot is an android banking trojan that uses overlays.

      bankertrojaninfostealerflubot

    • FluBot Payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

      evasion

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1

MITRE ATT&CK Matrix

Tasks