Overview

overview

10

Static

static

7

2c74efb0e8...6c.apk

android_x86

10

2c74efb0e8...6c.apk

android_x64

10

2c74efb0e8...6c.apk

android_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c74efb0e8304948e56f4ccb1ced6c05734842ecdc95628decacfa74d06baf6c.apk

  • Size

    5.0MB

  • Sample

    220616-vbvmtsaff7

  • MD5

    729160d423c809ec7d4802fef9010076

  • SHA1

    05e887acc64b92764a7ce9156745e59b42f1144a

  • SHA256

    2c74efb0e8304948e56f4ccb1ced6c05734842ecdc95628decacfa74d06baf6c

  • SHA512

    629e172df2ee3d0a2389f2dfe6cef08b034fcaf07d0136949d06b13b45514d7c98f67da0f22f7491ab9ef9eede945f4267a3604a70effa0aaee9a3b9cc18f8bf

Score
10/10
flubotandroidbankerinfostealerransomwaretrojan

Malware Config

Targets

    • Target

      2c74efb0e8304948e56f4ccb1ced6c05734842ecdc95628decacfa74d06baf6c.apk

    • Size

      5.0MB

    • MD5

      729160d423c809ec7d4802fef9010076

    • SHA1

      05e887acc64b92764a7ce9156745e59b42f1144a

    • SHA256

      2c74efb0e8304948e56f4ccb1ced6c05734842ecdc95628decacfa74d06baf6c

    • SHA512

      629e172df2ee3d0a2389f2dfe6cef08b034fcaf07d0136949d06b13b45514d7c98f67da0f22f7491ab9ef9eede945f4267a3604a70effa0aaee9a3b9cc18f8bf

    Score
    10/10
    flubotbankerinfostealerransomwaretrojan

    • FluBot

      FluBot is an android banking trojan that uses overlays.

      bankertrojaninfostealerflubot

    • FluBot Payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks