Overview

overview

10

Static

static

7

1dc84f5f1e...ea.apk

android_x86

10

1dc84f5f1e...ea.apk

android_x64

10

1dc84f5f1e...ea.apk

android_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1dc84f5f1ee6daf33f5da0d0d82f252c64274a771c6214170eae441d18447fea

  • Size

    4.8MB

  • Sample

    220616-xdq4jagffk

  • MD5

    d086e98cc813dc57c3b2b9a299ae2928

  • SHA1

    94078ef7ca8fbecd5194f082902ca991650e29e7

  • SHA256

    1dc84f5f1ee6daf33f5da0d0d82f252c64274a771c6214170eae441d18447fea

  • SHA512

    dfccb95a17e570225938bfa82d6a9d8c1f22e172e45c8a357b3a05d64ba670d372d69d38e92d9250191f10db454a2246d2ab5877fb759ee0bd2bd33b199a16cc

Score
10/10
flubotandroidbankerevasioninfostealerransomwaretrojan

Malware Config

Targets

    • Target

      1dc84f5f1ee6daf33f5da0d0d82f252c64274a771c6214170eae441d18447fea

    • Size

      4.8MB

    • MD5

      d086e98cc813dc57c3b2b9a299ae2928

    • SHA1

      94078ef7ca8fbecd5194f082902ca991650e29e7

    • SHA256

      1dc84f5f1ee6daf33f5da0d0d82f252c64274a771c6214170eae441d18447fea

    • SHA512

      dfccb95a17e570225938bfa82d6a9d8c1f22e172e45c8a357b3a05d64ba670d372d69d38e92d9250191f10db454a2246d2ab5877fb759ee0bd2bd33b199a16cc

    Score
    10/10
    flubotbankerevasioninfostealerransomwaretrojan

    • FluBot

      FluBot is an android banking trojan that uses overlays.

      bankertrojaninfostealerflubot

    • FluBot Payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Removes a system notification.

      evasion

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks