dogerat | a778818cc08d213d1f66db5fa8b34aabc862569ecb99fd1aea37ff6ccab48400

Resubmissions

10/12/2023, 03:07

231210-dmancsdcf710

10/12/2023, 01:55

231210-cb476abdfr10

10/12/2023, 01:24

231210-bsmh1acgf710

10/12/2023, 01:17

231210-bnjasabbgp10

Sharing

Copy URL Twitter E-mail

General

Target
15328ea6d31bef8ddd15a81e0f5a549b.bin
Size 3.3MB
Sample231210-dmancsdcf7
SHA256 a778818cc08d213d1f66db5fa8b34aabc862569ecb99fd1aea37ff6ccab48400
MD5 15328ea6d31bef8ddd15a81e0f5a549b
SHA1 c52f12651d91a9bf0d625a879b34d194eba69ed4
SHA512 5939a527d289315ff6d354bbd6e834ae9b3f452aebc54114a0fb46cb5422e5537ff0592aa62fbd20d753162f6a3ae56cfd97c4320613d1377a9b5a7d6a525336
SSDEEP 49152:qLzu436uB6iejEyNRe1kqqGI18iNwDelhcTUr4T1S0NwBbGJ3H5+ELr42SKn2IQI:qHuKB6BzReWqqGWNN8g4ETBaJ7n2Izl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  15328ea6d31bef8ddd15a81e0f5a549b.bin
- Size 3.3MB
- SHA256 a778818cc08d213d1f66db5fa8b34aabc862569ecb99fd1aea37ff6ccab48400
- MD5 15328ea6d31bef8ddd15a81e0f5a549b
- SHA1 c52f12651d91a9bf0d625a879b34d194eba69ed4
- SHA512 5939a527d289315ff6d354bbd6e834ae9b3f452aebc54114a0fb46cb5422e5537ff0592aa62fbd20d753162f6a3ae56cfd97c4320613d1377a9b5a7d6a525336
- SSDEEP 49152:qLzu436uB6iejEyNRe1kqqGI18iNwDelhcTUr4T1S0NwBbGJ3H5+ELr42SKn2IQI:qHuKB6BzReWqqGWNN8g4ETBaJ7n2Izl
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

flubot banker discovery evasion infostealer trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Requests enabling of the accessibility settings.
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

FluBot

FluBot payload

Makes use of the framework's Accessibility service

Loads dropped Dex/Jar

Requests enabling of the accessibility settings.

Creates a large amount of network flows

Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3