Overview

overview

10

Static

static

6

97206706b5...a5.apk

 

97206706b5...a5.apk

android-10-x64

10

97206706b5...a5.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    97206706b5aa31cebb8ac30102632d3072bd00b1bc6d9a097db417974dca69a5

  • Size

    4.5MB

  • Sample

    231220-kmjplagab3

  • MD5

    f9a79cb761afbb4315840408e14c5a6b

  • SHA1

    f5e6549a76e9713f961fa9c7855b9cc9ffc5cf0a

  • SHA256

    97206706b5aa31cebb8ac30102632d3072bd00b1bc6d9a097db417974dca69a5

  • SHA512

    d9b92df7f9ae8c4d8f36c93f454c4df84b609aab94910bca73fdff7db673fbec2490ab38adb634c9006c7690c6064bf0c4edd4acf236add6f93d9f7fa99e9f7d

  • SSDEEP

    98304:6ybtPX2a3eE3ldgwnvK6t9bVCNJd1IWTryoa:NbrOE3lqwnvKu9bVC3zIOm

Score
10/10
flubotandroidbankerevasioninfostealerstealthtrojan

Malware Config

Targets

    • Target

      97206706b5aa31cebb8ac30102632d3072bd00b1bc6d9a097db417974dca69a5

    • Size

      4.5MB

    • MD5

      f9a79cb761afbb4315840408e14c5a6b

    • SHA1

      f5e6549a76e9713f961fa9c7855b9cc9ffc5cf0a

    • SHA256

      97206706b5aa31cebb8ac30102632d3072bd00b1bc6d9a097db417974dca69a5

    • SHA512

      d9b92df7f9ae8c4d8f36c93f454c4df84b609aab94910bca73fdff7db673fbec2490ab38adb634c9006c7690c6064bf0c4edd4acf236add6f93d9f7fa99e9f7d

    • SSDEEP

      98304:6ybtPX2a3eE3ldgwnvK6t9bVCNJd1IWTryoa:NbrOE3lqwnvKu9bVC3zIOm

    Score
    10/10
    flubotbankerinfostealerstealthtrojanevasion

    • FluBot

      FluBot is an android banking trojan that uses overlays.

      bankertrojaninfostealerflubot

    • FluBot payload

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Removes its main activity from the application launcher

      stealthtrojan

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks