Overview

overview

10

Static

static

6

305c6ef783...d6.apk

android-9-x86

10

305c6ef783...d6.apk

android-10-x64

10

305c6ef783...d6.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    305c6ef783ba3db66c8b3262d0ad26d6

  • Size

    3.3MB

  • Sample

    231231-k57jdaaeb8

  • MD5

    305c6ef783ba3db66c8b3262d0ad26d6

  • SHA1

    efd066effa3bfea6c04521a1b32c417f9d19ed34

  • SHA256

    dcfe4d8c0265186f24f56cb774f0087cfde3d46fc0d31a7edf7e036a2006513d

  • SHA512

    b625d6838cd10bb75cf4e25e97e98c3bbbbdf51c020a085ba140dd036994c1f6661efab53b4dbfd42e77f52eee11200537e8f87b851509640ac09886792e5a03

  • SSDEEP

    49152:q77+QbVwYD57Qyr5nsqNz+yBcvPDCkUHXCKgNwVQX3pUyN7AYpDMaSwXZ4coH:qX+AD57QyrKZOcDrjGVzyZAWRS+Zm

Score
10/10
flubotandroidbankerdiscoveryevasioninfostealertrojan

Malware Config

Targets

    • Target

      305c6ef783ba3db66c8b3262d0ad26d6

    • Size

      3.3MB

    • MD5

      305c6ef783ba3db66c8b3262d0ad26d6

    • SHA1

      efd066effa3bfea6c04521a1b32c417f9d19ed34

    • SHA256

      dcfe4d8c0265186f24f56cb774f0087cfde3d46fc0d31a7edf7e036a2006513d

    • SHA512

      b625d6838cd10bb75cf4e25e97e98c3bbbbdf51c020a085ba140dd036994c1f6661efab53b4dbfd42e77f52eee11200537e8f87b851509640ac09886792e5a03

    • SSDEEP

      49152:q77+QbVwYD57Qyr5nsqNz+yBcvPDCkUHXCKgNwVQX3pUyN7AYpDMaSwXZ4coH:qX+AD57QyrKZOcDrjGVzyZAWRS+Zm

    Score
    10/10
    flubotbankerdiscoveryevasioninfostealertrojan

    • FluBot

      FluBot is an android banking trojan that uses overlays.

      bankertrojaninfostealerflubot

    • FluBot payload

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks