General
-
Target
9f41dff89cd49eadea3d1e3b98b58402b9cda6b54eebc62a371568b5a607d849.apk
-
Size
3.0MB
-
Sample
220616-vbfhxagbbm
-
MD5
6410a472bd0c90fa069bfacf10cdc840
-
SHA1
1a822e7e3f915353b723009c47b981048c847210
-
SHA256
9f41dff89cd49eadea3d1e3b98b58402b9cda6b54eebc62a371568b5a607d849
-
SHA512
87c34a6b9fd14dea07aa0ed9b7b4fd616b81b7aa6b9ebbd9c25297c4681735b7212b80da7a94fe740aed2073a799e6c111d538ebb1e2593c1cabf3c65a76fef6
Malware Config
Targets
-
-
Target
9f41dff89cd49eadea3d1e3b98b58402b9cda6b54eebc62a371568b5a607d849.apk
-
Size
3.0MB
-
MD5
6410a472bd0c90fa069bfacf10cdc840
-
SHA1
1a822e7e3f915353b723009c47b981048c847210
-
SHA256
9f41dff89cd49eadea3d1e3b98b58402b9cda6b54eebc62a371568b5a607d849
-
SHA512
87c34a6b9fd14dea07aa0ed9b7b4fd616b81b7aa6b9ebbd9c25297c4681735b7212b80da7a94fe740aed2073a799e6c111d538ebb1e2593c1cabf3c65a76fef6
Score10/10-
FluBot
FluBot is an android banking trojan that uses overlays.
-
FluBot Payload
-
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
-
Makes use of the framework's Accessibility service.
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Removes a system notification.
-
Uses Crypto APIs (Might try to encrypt user data).
-