Overview

overview

10

Static

static

7

base.apk

android-9-x86

10

base.apk

android-10-x64

10

base.apk

android-11-x64

10

Zw6IGlco.ppt

windows7-x64

1

Zw6IGlco.ppt

windows10-2004-x64

1

license-ru.html

windows7-x64

1

license-ru.html

windows10-2004-x64

1

license.html

windows7-x64

1

license.html

windows10-2004-x64

1

UserDict.pyc

windows7-x64

3

UserDict.pyc

windows10-2004-x64

3

_abcoll.pyc

windows7-x64

3

_abcoll.pyc

windows10-2004-x64

3

_sysconfigdata.pyc

windows7-x64

3

_sysconfigdata.pyc

windows10-2004-x64

3

_weakrefset.pyc

windows7-x64

3

_weakrefset.pyc

windows10-2004-x64

3

abc.pyc

windows7-x64

3

abc.pyc

windows10-2004-x64

3

copy_reg.pyc

windows7-x64

3

copy_reg.pyc

windows10-2004-x64

3

genericpath.pyc

windows7-x64

3

genericpath.pyc

windows10-2004-x64

3

linecache.pyc

windows7-x64

3

linecache.pyc

windows10-2004-x64

3

os.pyc

windows7-x64

3

os.pyc

windows10-2004-x64

3

posixpath.pyc

windows7-x64

3

posixpath.pyc

windows10-2004-x64

3

re.pyc

windows7-x64

3

re.pyc

windows10-2004-x64

3

site.pyc

windows7-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    base.apk

  • Size

    3.3MB

  • Sample

    230612-h8ypjabe91

  • MD5

    15328ea6d31bef8ddd15a81e0f5a549b

  • SHA1

    c52f12651d91a9bf0d625a879b34d194eba69ed4

  • SHA256

    a778818cc08d213d1f66db5fa8b34aabc862569ecb99fd1aea37ff6ccab48400

  • SHA512

    5939a527d289315ff6d354bbd6e834ae9b3f452aebc54114a0fb46cb5422e5537ff0592aa62fbd20d753162f6a3ae56cfd97c4320613d1377a9b5a7d6a525336

  • SSDEEP

    49152:qLzu436uB6iejEyNRe1kqqGI18iNwDelhcTUr4T1S0NwBbGJ3H5+ELr42SKn2IQI:qHuKB6BzReWqqGWNN8g4ETBaJ7n2Izl

Score
10/10
flubotandroidbankerdiscoveryevasioninfostealertrojan

Malware Config

Targets

    • Target

      base.apk

    • Size

      3.3MB

    • MD5

      15328ea6d31bef8ddd15a81e0f5a549b

    • SHA1

      c52f12651d91a9bf0d625a879b34d194eba69ed4

    • SHA256

      a778818cc08d213d1f66db5fa8b34aabc862569ecb99fd1aea37ff6ccab48400

    • SHA512

      5939a527d289315ff6d354bbd6e834ae9b3f452aebc54114a0fb46cb5422e5537ff0592aa62fbd20d753162f6a3ae56cfd97c4320613d1377a9b5a7d6a525336

    • SSDEEP

      49152:qLzu436uB6iejEyNRe1kqqGI18iNwDelhcTUr4T1S0NwBbGJ3H5+ELr42SKn2IQI:qHuKB6BzReWqqGWNN8g4ETBaJ7n2Izl

    Score
    10/10
    flubotbankerdiscoveryevasioninfostealertrojan

    • FluBot

      FluBot is an android banking trojan that uses overlays.

      bankertrojaninfostealerflubot

    • FluBot payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion
    behavioral1behavioral2behavioral3

    • Target

      Zw6IGlco.ppt

    • Size

      858KB

    • MD5

      8148fdd8a42ed51a318d6171f8b27109

    • SHA1

      65b324c70264c6b8442601c74bc0755e70b9768c

    • SHA256

      eff54ee3e4c42998b978e3ad85f08f6ca5b03836ea56d76d7cacfe0906fec0a4

    • SHA512

      f0518d0e17c2855bec41d1b5767755edd6fd6c747da741e78a8351b7e8e0de8c7b9f80ff44dea8289557fee35da3de5e0101310ca9a2998922be94dfebf22c7a

    • SSDEEP

      24576:IQbHPVatL2naYSfu5rC+/sQsuAP2//IZJ:IQbHPjEu5rCYsQBBIX

    Score
    1/10
    behavioral4behavioral5

    • Target

      license-ru.html

    • Size

      34KB

    • MD5

      ac6e15df193c7135c916f85fd48afecd

    • SHA1

      bc11e538662c15a478b3cbf8cbf0873b8f19ec9e

    • SHA256

      a1b20292621b8ba67ddfb61802bd12bade68f6b930ac6ad61e89c047a1f91c22

    • SHA512

      bcd3d439b0b25ba3de815f00ff92bf3545578d90d53adacc2b272b60ee8bf3d65e460d87fbdc56eec32344d8be567b1f7384fb9c8b0934b24cec39ce05b7c8e1

    • SSDEEP

      384:8JF/uQenaw/h+pMNbK+v5AKVjZI89GThAKJPrLqCu2WVgqxk/d1NDlCPjOB4WUen:4e9hDbE4nGThAUTDmI4WUE8Z+

    Score
    1/10
    behavioral6behavioral7

    • Target

      license.html

    • Size

      18KB

    • MD5

      57d40cdb2111f13e40a7c92af27d27b4

    • SHA1

      27f72955eb424eef52715ccbde22d1cb5b23f622

    • SHA256

      7dda06156acbe260754bf5cb0ff2acce418c4b2a7ddf4176fb4e2c892dd85ebc

    • SHA512

      8fa42a10812c9ef10327caf5d8b618cda0bfdcf477f7914e8448175024cbcde7ae1a5ac47eb3e1d4500ad1cb7e904a22e97c2e1956aa274182753927cddf5b0a

    • SSDEEP

      384:CwQfL6d89D4eefdN7aEGJ6Eyz6h9rx3pc/:Vo6d5eMdNbxEyaJTc/

    Score
    1/10
    behavioral8behavioral9

    • Target

      UserDict.pyc

    • Size

      11KB

    • MD5

      efcbe1f3ba66174c7498b9d02b74c84c

    • SHA1

      dbe94d3516b2b179124dbb7db5fa6241c3e6045c

    • SHA256

      94dd9035bc81842df7e50550da82db7bcf3d2786387c34bca660e0836d67e9b3

    • SHA512

      b3133caccd23b2598a10e38d08b5338426b2bd4488f984841535dd8802054619690b7763e1c38c5a61e9de1f7d15543fb0da6d91672256649022f3aa858d510d

    • SSDEEP

      192:rhktDonbVYqbaighlUFLynIxNaHH28fbKHO0uo9DIKJq70KZEJ4blivYbi5+SH5P:3nbOqbaiAqFLynIxNanBfOO0uoaKJq7G

    Score
    3/10
    behavioral10behavioral11

    • Target

      _abcoll.pyc

    • Size

      30KB

    • MD5

      fc3696b4a60393354be0558f3e838074

    • SHA1

      14a52a71d9fd9730fd80225d6cb35b2da34aafd0

    • SHA256

      10303f6affdd674dfefe3b5e97c165d0d50218ec0a377f70c2887b76afad4183

    • SHA512

      8814525e1b5b252949621c5a935b534a47a18b34a1269161f8ebb1be6648d31f9abb515ab632f9cc3676b9433a8c30d6d211cab9b665257a80dde9643750163b

    • SSDEEP

      384:j6s8jgb7ZNW7dh8fZimJ2vlfwqqS0H/DExQ4AME6Tkc:j6s8EZNyOZimEvOqqS0HivE6Tkc

    Score
    3/10
    behavioral12behavioral13

    • Target

      _sysconfigdata.pyc

    • Size

      20KB

    • MD5

      934699af3b14cb5c632aefc2d86cb3b7

    • SHA1

      3ee3e6cadba5e72a6686e22b8a71d0000373f50e

    • SHA256

      046cc6eb5e2b675e6114962743d423e52f14c931ea35e7e117710251cc177dbf

    • SHA512

      f6ea4b0412e13cac50c820969501ba23192c9dd06066005db8dc9a63af9cd36b187e189e9a4f5dd66872d5661d38210a69a00f0893d729f84b5c993b35b6783c

    • SSDEEP

      384:f6KrM1y5Nz+bEtkjoLHvPWUS85cDWzy9uIu4JiyBK125Fk8Z:fvcm+bAAWzy9ux4JQg5PZ

    Score
    3/10
    behavioral14behavioral15

    • Target

      _weakrefset.pyc

    • Size

      11KB

    • MD5

      685d4aaf13a4f2bb43bec6340f853fa2

    • SHA1

      2cbbad3829a7ecb101e1fe58e34b8651bc153389

    • SHA256

      ac2dfa51d2edb55548f68ac15279b9e09944dda301478e2bb533e7948ed6187c

    • SHA512

      76dcca6e3b7f93155bdbac2f5f94878b710de381c5732e64ef6432f7d709d111640868ea37d70400c4805cbf65289d18a88885f446cb7a25c110cecfa652b4d2

    • SSDEEP

      192:s+2JxBMBSmGt2ob/rxBZ9qpa/awsHXqe11ZFKFbnaJ6My:Pofm5ojd9H/gHaoZQbgXy

    Score
    3/10
    behavioral16behavioral17

    • Target

      abc.pyc

    • Size

      6KB

    • MD5

      77d1073653635e1d64467985019e2804

    • SHA1

      63b8f4bdcc9b62736cdb7bb4db232e1a778dd244

    • SHA256

      6c147d0976c7e7333ec9bc7a37e5191a602b10775bed9543cea99a4b8b08a747

    • SHA512

      d00fc86e19194dcd781a9ab18cf34e008d3fedc9584a87459b64aacfea83a2e97660763a5d34c526800266d8588c85d4118ed4eb3432eea0840faa676591a7cc

    • SSDEEP

      96:l8Cx06+SenQH/0x0CenQ9ZY6kj152Hvk2aqNonSmfcTxj+k6zB+BELfwLt2C2te:62+xf8152Pk2aioXfcMVyt22

    Score
    3/10
    behavioral18behavioral19

    • Target

      copy_reg.pyc

    • Size

      5KB

    • MD5

      9131bcc5ebe103546f257340d46bea53

    • SHA1

      2d7bbbc8d3e7095cfebebe27ac2d9bc20acb37ef

    • SHA256

      aa95b3eae84b84e3cf63f65737b120aa69394bc8f91d7a6a0e11fb56da12aee0

    • SHA512

      1a5223abb04f73df775692a43e16bed606daf3736b75ccdeaf90e898a3856c5723878b7b492e19a1858844280bd9cbdab1bbea1af581a003ac0e515a3b78eb5e

    • SSDEEP

      96:U1EMLsP6SyZ2Ozlye0mpiMzkWaIoB0jkvfq1Td2wLHKnT4mIT2zHCTLRaLfhb:BcsCBDv1oRnmjYfe2SHKnT4mA2zHCTLW

    Score
    3/10
    behavioral20behavioral21

    • Target

      genericpath.pyc

    • Size

      3KB

    • MD5

      9218a22bb71073ba455b83f245af3893

    • SHA1

      04f6e152e228035575ac3a8ce950595d5f96e0f4

    • SHA256

      89a30b8bcf984d0d5538e086c2e5e76f9683d0d87c711a8fb4389331d4342807

    • SHA512

      2518d77e3d37621875768e42818c1051629fbbd0be1f213881843695f910c054dbf1cd040c855fec361f68308aa057d10a8e7efc3ac56d3664e4e812695f9e81

    Score
    3/10
    behavioral22behavioral23

    • Target

      linecache.pyc

    • Size

      3KB

    • MD5

      749ac324b80b41cc7c03720abc918cac

    • SHA1

      eae24d0aeca6f66b6233e7cb3d4b7186739be29b

    • SHA256

      fc55d0442cdf69c8762a30a66ee7231be46c5dcae3bb81177062732857d0292c

    • SHA512

      208ed9e0070bbb791dbf255b143428c6fb2ae710fd813b10a80fa6f6c3f8bd3d55caf684db444992192751677ae0033f0444e3b0e1475ce30d9d73cad6eb2596

    Score
    3/10
    behavioral24behavioral25

    • Target

      os.pyc

    • Size

      27KB

    • MD5

      d845a1698a5e4a9a3992ca514b924a52

    • SHA1

      daef45b912f6ebc4d7d6d2d1ed7234b1f7769954

    • SHA256

      ec16d78fff77115582630db2aa0167617e5e490785f634172e9570f014322f3c

    • SHA512

      5a8ba0a5c0b45812b35d3546b5c3fbc48b445aee32089417e261d3ddfea508d3df7b3536c11d662d6993a6fb09de4d234b1b1896a810da0d2d60cfc1edb9942b

    • SSDEEP

      768:BCa184aJH8ys0lG5ufiMq+7KTLrLjL1LDL3LnLnLcyW0t:oaeJH8ysAiMq+7K1Nt

    Score
    3/10
    behavioral26behavioral27

    • Target

      posixpath.pyc

    • Size

      12KB

    • MD5

      3795e4cbeec84cbd8b1073bf98cf01ac

    • SHA1

      cbe1148996ae54fdc2a873a114fd79f40da8dcd8

    • SHA256

      f17b70ec5fa6535961486cf601a3a1ea6e89f695c8ffe38d7fc7b128a1835386

    • SHA512

      d7f768a1820f37ec44835ab25b405ec84567be6e0547f99ed5ea66c9ec75fcabbf554311f1888181a024709389c4bc9d1a6dac4b5c17149def73c43ed672be18

    • SSDEEP

      384:Oo+731JjMvXW7c+XaXzFJM+7ciCYrdZPAzPLEgcv:Oo837jGXqc+XaXzFJMwciLU0ge

    Score
    3/10
    behavioral28behavioral29

    • Target

      re.pyc

    • Size

      14KB

    • MD5

      c4c8225af08a68323823b7323f15f117

    • SHA1

      a57deabed7a661d59350b5692095db9d12a0c709

    • SHA256

      4266137f82d1bf4c1b0d20d9ea0d45ba8f1aa6fca15140fe30fd0dd99d6ff21e

    • SHA512

      42ae0fb234c13a8e1f73f72c030d2585b0e062ba1b33d8743db2aa1e415b79c26bd6c687f56f8de88747ed6c090c07b723e47caa0225507609e7bf3315e0bb72

    • SSDEEP

      192:dLhuPG2DARzAuXTCQL5rPb+mPNGL6R/UX8tcFfesWtGAsZCNe7Ms:nuPjDssWPSIMX8tYfepGr1

    Score
    3/10
    behavioral30behavioral31

    • Target

      site.pyc

    • Size

      20KB

    • MD5

      da415177f27719df853538683867092c

    • SHA1

      316afbd9219b195074fe3e211752908385c7c11c

    • SHA256

      0c7c594e3a7008840c9d25ac0eaeb6f8dd1c3b4467d6851dbdc790c88ac96463

    • SHA512

      9ab1ba6b662b794b9b0b06839a8d4cf51f7ef00487c34ce1d746fa915eed05fbddbb51c99cc6b138925444dfbdbb638d8b3f7dadaa3993a1285a4dddfc142e18

    • SSDEEP

      384:Sl8YYllwXc9U8uMNC9yLSt298mLIBRCw4JmtqSUn7Q8kRU4mnE6B:NllAafuMw4GRsIBRC1Fnn0LWXnE6B

    Score
    3/10
    behavioral32

MITRE ATT&CK Enterprise v6

Tasks

static1

Score
7/10

behavioral1

flubotbankerdiscoveryevasioninfostealertrojan
Score
10/10

behavioral2

flubotbankerinfostealertrojan
Score
10/10

behavioral3

flubotbankerevasioninfostealertrojan
Score
10/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
3/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
3/10

behavioral18

Score
3/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

Score
3/10

behavioral22

Score
3/10

behavioral23

Score
3/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

Score
3/10

behavioral28

Score
3/10

behavioral29

Score
3/10

behavioral30

Score
3/10

behavioral31

Score
3/10

behavioral32

Score
3/10

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.