Overview

overview

10

Static

static

7

9b04500fcd...93.apk

android-9-x86

10

9b04500fcd...93.apk

android-10-x64

10

9b04500fcd...93.apk

android-11-x64

10

sConsole.html

windows7-x64

1

sConsole.html

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9b04500fcd4237ddb27a25cf4483bbefe03c6aaf12500c0b7b46ed898f999393.bin

  • Size

    4.8MB

  • Sample

    231126-1wttxsce51

  • MD5

    ca5240489cfb5b97fde09a85e2d90c9b

  • SHA1

    26517a68db93bb36ebf31c2fe4b4b8c0f2fc3c84

  • SHA256

    9b04500fcd4237ddb27a25cf4483bbefe03c6aaf12500c0b7b46ed898f999393

  • SHA512

    df458a089cd18e0cb8e80e8e8eb81d5ad0b9f16c7dddfb968e0a50ac356dffb9149b6957d3b27d4908cc1da366fae98736cb650f5ad8f988f2a63945cf1aeae4

  • SSDEEP

    98304:u9srlNqjQuH5a3udaBi/coneFEGOlOKQr3lIrSTjorzM13/wkT:u9srlia3mQgMO47lIrSXU83xT

Score
10/10
flubotandroidbankerdiscoveryevasioninfostealerransomwarestealthtrojan

Malware Config

Targets

    • Target

      9b04500fcd4237ddb27a25cf4483bbefe03c6aaf12500c0b7b46ed898f999393.bin

    • Size

      4.8MB

    • MD5

      ca5240489cfb5b97fde09a85e2d90c9b

    • SHA1

      26517a68db93bb36ebf31c2fe4b4b8c0f2fc3c84

    • SHA256

      9b04500fcd4237ddb27a25cf4483bbefe03c6aaf12500c0b7b46ed898f999393

    • SHA512

      df458a089cd18e0cb8e80e8e8eb81d5ad0b9f16c7dddfb968e0a50ac356dffb9149b6957d3b27d4908cc1da366fae98736cb650f5ad8f988f2a63945cf1aeae4

    • SSDEEP

      98304:u9srlNqjQuH5a3udaBi/coneFEGOlOKQr3lIrSTjorzM13/wkT:u9srlia3mQgMO47lIrSXU83xT

    Score
    10/10
    flubotbankerdiscoveryevasioninfostealerransomwarestealthtrojan

    • FluBot

      FluBot is an android banking trojan that uses overlays.

      bankertrojaninfostealerflubot

    • FluBot payload

    • Makes use of the framework's Accessibility service.

    • Removes its main activity from the application launcher

      stealthtrojan

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2behavioral3

    • Target

      sConsole.html

    • Size

      269B

    • MD5

      76cff191be980267fa533e55a9239ab7

    • SHA1

      402d6414f2831b4ca167053a34c47a0c7673d24f

    • SHA256

      864366803cea1cd7ae018366765a30a0a619be881b947a4c5f2fa2af751732a7

    • SHA512

      7c8263eacf5d4a484fdb0e94f175057286055996cde69d6107cc0d5bca87c892a3c05f286d48dfb9ccfc6706a327441ff25248fba11d5e7db7f0762fbfe07d9b

    Score
    1/10
    behavioral4behavioral5

MITRE ATT&CK Enterprise v15

Tasks