General

  • Target

    67566e6554dc10d6d3f043a80bed57bf

  • Size

    3.1MB

  • Sample

    240119-l3hmxaccb8

  • MD5

    67566e6554dc10d6d3f043a80bed57bf

  • SHA1

    1cfe27325f5860d304163eba7ed57f26a64a1c8a

  • SHA256

    0c71f0d68606997d53086b5e7149b2ade9db3cff22969f518e7694ecad4eda18

  • SHA512

    d47064c757a6bbf80bb59fb429f1cb34042bdc64ccf4f69273137e75f0c08a5ace39571cc8c6fe727d6c6e6c8c37303d3cf82f33fe2bbe9b820ed6d3dfc0656b

  • SSDEEP

    49152:dMPkOWjsJTBVAnZ7Yc0UavlSLz+Cq1z6SYsQ97MqKJ2WhOhzOXNwskZRyFc1KEOS:dM0yQZU5Sex68QLKSyOsccQ/O0A78Go

Malware Config

Targets

    • Target

      67566e6554dc10d6d3f043a80bed57bf

    • Size

      3.1MB

    • MD5

      67566e6554dc10d6d3f043a80bed57bf

    • SHA1

      1cfe27325f5860d304163eba7ed57f26a64a1c8a

    • SHA256

      0c71f0d68606997d53086b5e7149b2ade9db3cff22969f518e7694ecad4eda18

    • SHA512

      d47064c757a6bbf80bb59fb429f1cb34042bdc64ccf4f69273137e75f0c08a5ace39571cc8c6fe727d6c6e6c8c37303d3cf82f33fe2bbe9b820ed6d3dfc0656b

    • SSDEEP

      49152:dMPkOWjsJTBVAnZ7Yc0UavlSLz+Cq1z6SYsQ97MqKJ2WhOhzOXNwskZRyFc1KEOS:dM0yQZU5Sex68QLKSyOsccQ/O0A78Go

    • FluBot

      FluBot is an android banking trojan that uses overlays.

    • FluBot payload

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

MITRE ATT&CK Enterprise v15

Tasks