dogerat | a778818cc08d213d1f66db5fa8b34aabc862569ecb99fd1aea37ff6ccab48400

Resubmissions

10-12-2023 03:07

231210-dmancsdcf7 10

10-12-2023 01:55

231210-cb476abdfr 10

10-12-2023 01:24

231210-bsmh1acgf7 10

10-12-2023 01:17

231210-bnjasabbgp 10

Sharing

Copy URL

Twitter E-mail

General

Target

15328ea6d31bef8ddd15a81e0f5a549b.bin
Size

3.3MB
Sample

231210-dmancsdcf7
MD5

15328ea6d31bef8ddd15a81e0f5a549b
SHA1

c52f12651d91a9bf0d625a879b34d194eba69ed4
SHA256

a778818cc08d213d1f66db5fa8b34aabc862569ecb99fd1aea37ff6ccab48400
SHA512

5939a527d289315ff6d354bbd6e834ae9b3f452aebc54114a0fb46cb5422e5537ff0592aa62fbd20d753162f6a3ae56cfd97c4320613d1377a9b5a7d6a525336
SSDEEP

49152:qLzu436uB6iejEyNRe1kqqGI18iNwDelhcTUr4T1S0NwBbGJ3H5+ELr42SKn2IQI:qHuKB6BzReWqqGWNN8g4ETBaJ7n2Izl

Score

10^/10

Malware Config

Targets

- Target
  
  15328ea6d31bef8ddd15a81e0f5a549b.bin
- Size
  
  3.3MB
- MD5
  
  15328ea6d31bef8ddd15a81e0f5a549b
- SHA1
  
  c52f12651d91a9bf0d625a879b34d194eba69ed4
- SHA256
  
  a778818cc08d213d1f66db5fa8b34aabc862569ecb99fd1aea37ff6ccab48400
- SHA512
  
  5939a527d289315ff6d354bbd6e834ae9b3f452aebc54114a0fb46cb5422e5537ff0592aa62fbd20d753162f6a3ae56cfd97c4320613d1377a9b5a7d6a525336
- SSDEEP
  
  49152:qLzu436uB6iejEyNRe1kqqGI18iNwDelhcTUr4T1S0NwBbGJ3H5+ELr42SKn2IQI:qHuKB6BzReWqqGWNN8g4ETBaJ7n2Izl
Score

10^/10

flubot banker discovery evasion infostealer trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Requests enabling of the accessibility settings.
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

FluBot

FluBot payload

Makes use of the framework's Accessibility service

Loads dropped Dex/Jar

Requests enabling of the accessibility settings.

Creates a large amount of network flows

Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3