General
- Target Flubot49.apk
- Size 4.3MB
- Sample220616-vb9fzsaff8
- SHA256 6e3499a5e63209b34ccc787a7ea57953ff5436b51ca4325ea0da4a958f44ea7b
Score
10/10
Malware Config
Targets
-
- Target Flubot49.apk
- Size 4.3MB
- SHA256 6e3499a5e63209b34ccc787a7ea57953ff5436b51ca4325ea0da4a958f44ea7b
Score10/10-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload
-
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
-
Makes use of the framework's Accessibility service.
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Uses Crypto APIs (Might try to encrypt user data).