Overview

overview

10

Static

static

6

854c30bf0c...b8.apk

android-9-x86

10

854c30bf0c...b8.apk

android-10-x64

10

854c30bf0c...b8.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    854c30bf0c1a28a885f961428f462241a2aaa3f3977433385ff9e2291e1cf0b8

  • Size

    5.8MB

  • Sample

    231220-fgg7cscedk

  • MD5

    5f13277525cd49fe9faadb4991c3e184

  • SHA1

    bc846998b592dc71c19a20fcdde0bdf4e208f5e9

  • SHA256

    854c30bf0c1a28a885f961428f462241a2aaa3f3977433385ff9e2291e1cf0b8

  • SHA512

    c7c105ea03b5a968a5b592b8132c080c04bfba5c930cabd90aee84108b6672c603ee3e291dec0942eeb36db1b859ccce84bd0d28fb1edb5a55968a23ccaeaa8d

  • SSDEEP

    98304:IevZEuKg3P8VajEu2XrsfdLppLe819z8KeJvcBvzatt102faYx6/4KTNEY4htwln:IOK3HQpToKCIz6102faY4j+3ax

Score
10/10
flubotandroidbankerevasioninfostealerstealthtrojan

Malware Config

Targets

    • Target

      854c30bf0c1a28a885f961428f462241a2aaa3f3977433385ff9e2291e1cf0b8

    • Size

      5.8MB

    • MD5

      5f13277525cd49fe9faadb4991c3e184

    • SHA1

      bc846998b592dc71c19a20fcdde0bdf4e208f5e9

    • SHA256

      854c30bf0c1a28a885f961428f462241a2aaa3f3977433385ff9e2291e1cf0b8

    • SHA512

      c7c105ea03b5a968a5b592b8132c080c04bfba5c930cabd90aee84108b6672c603ee3e291dec0942eeb36db1b859ccce84bd0d28fb1edb5a55968a23ccaeaa8d

    • SSDEEP

      98304:IevZEuKg3P8VajEu2XrsfdLppLe819z8KeJvcBvzatt102faYx6/4KTNEY4htwln:IOK3HQpToKCIz6102faY4j+3ax

    Score
    10/10
    flubotbankerevasioninfostealerstealthtrojan

    • FluBot

      FluBot is an android banking trojan that uses overlays.

      bankertrojaninfostealerflubot

    • FluBot payload

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Removes its main activity from the application launcher

      stealthtrojan

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks