Overview

overview

10

Static

static

7

139fca7c97...3e.apk

android_x86

10

139fca7c97...3e.apk

android_x64

10

139fca7c97...3e.apk

android_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    139fca7c979e272ff720feffcaf686aeb1dd25a6347d34bbaa443031982d5f3e.apk

  • Size

    6.8MB

  • Sample

    220616-xh7l3sbbg9

  • MD5

    77c1fcc802753a77f042dc14863f9900

  • SHA1

    c56ec9ceafb44300acecaaf3a3049b64631ccd8f

  • SHA256

    139fca7c979e272ff720feffcaf686aeb1dd25a6347d34bbaa443031982d5f3e

  • SHA512

    0cf7d1e7c967210d027e1a945d2802e3baa458ca4cc77b3a1022890c005b627018cda5a226bf7185e742564707dff26503150d6c7faa935b60cdfb68141d4a81

Score
10/10
flubotandroidbankerinfostealerransomwaresuricatatrojan

Malware Config

Targets

    • Target

      139fca7c979e272ff720feffcaf686aeb1dd25a6347d34bbaa443031982d5f3e.apk

    • Size

      6.8MB

    • MD5

      77c1fcc802753a77f042dc14863f9900

    • SHA1

      c56ec9ceafb44300acecaaf3a3049b64631ccd8f

    • SHA256

      139fca7c979e272ff720feffcaf686aeb1dd25a6347d34bbaa443031982d5f3e

    • SHA512

      0cf7d1e7c967210d027e1a945d2802e3baa458ca4cc77b3a1022890c005b627018cda5a226bf7185e742564707dff26503150d6c7faa935b60cdfb68141d4a81

    Score
    10/10
    flubotbankerinfostealerransomwaresuricatatrojan

    • FluBot

      FluBot is an android banking trojan that uses overlays.

      bankertrojaninfostealerflubot

    • FluBot Payload

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks