Overview

overview

10

Static

static

7

1458b4858e...d7.apk

android-9-x86

10

1458b4858e...d7.apk

android-10-x64

10

1458b4858e...d7.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1458b4858ea9983227d68c70d2d9dcdf85c89e66aa9fc50879205d97e08fbbd7

  • Size

    5.5MB

  • Sample

    221109-m6gqfshhcq

  • MD5

    c090102914f9d558dca69c875428946f

  • SHA1

    4887d7a53823bee74d8610f6ba8d0a6163064c33

  • SHA256

    1458b4858ea9983227d68c70d2d9dcdf85c89e66aa9fc50879205d97e08fbbd7

  • SHA512

    1d47e0dd3c8045944cb3a1cf8595f30fd17229f394f0a526d4a7d0f83bdae57c62869cf801a9aa12e5635feea5d3598985101f2e39fdf8e0cf4c051f8683f59b

  • SSDEEP

    98304:lPXp1mY2iKPrYVisH/NhSQUtOejEgFIMKhUC7Q8MK4ShyxrB:NXTmR/YVisFUtdAgS7TMkhyNB

Score
10/10
flubotandroidbankerevasioninfostealerransomwaretrojan

Malware Config

Targets

    • Target

      1458b4858ea9983227d68c70d2d9dcdf85c89e66aa9fc50879205d97e08fbbd7

    • Size

      5.5MB

    • MD5

      c090102914f9d558dca69c875428946f

    • SHA1

      4887d7a53823bee74d8610f6ba8d0a6163064c33

    • SHA256

      1458b4858ea9983227d68c70d2d9dcdf85c89e66aa9fc50879205d97e08fbbd7

    • SHA512

      1d47e0dd3c8045944cb3a1cf8595f30fd17229f394f0a526d4a7d0f83bdae57c62869cf801a9aa12e5635feea5d3598985101f2e39fdf8e0cf4c051f8683f59b

    • SSDEEP

      98304:lPXp1mY2iKPrYVisH/NhSQUtOejEgFIMKhUC7Q8MK4ShyxrB:NXTmR/YVisFUtdAgS7TMkhyNB

    Score
    10/10
    flubotbankerevasioninfostealerransomwaretrojan

    • FluBot

      FluBot is an android banking trojan that uses overlays.

      bankertrojaninfostealerflubot

    • FluBot payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks