Overview

overview

10

Static

static

10

8b116440da...fd.apk

android-9-x86

10

8b116440da...fd.apk

android-10-x64

10

8b116440da...fd.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b116440dae67d7a258c225fd7770bfd

  • Size

    3.0MB

  • Sample

    240203-b5wx7sead7

  • MD5

    8b116440dae67d7a258c225fd7770bfd

  • SHA1

    975d318bc82096c586913654e9f15ca643cfabd7

  • SHA256

    7dcb4c377eebc1d4c5efd5ef873d9d82fc0dcf1ed1ec7ce9884ca09341fc012e

  • SHA512

    b3f64e1532f030988daef21287fd52f9d1abf9a3fcad8eb5e8edbcabd47c1d413259b00f5c409221ded18ba66c5639df13245438369f5bbf20094fffeedc559e

  • SSDEEP

    49152:nhyfByEPmieQpAkKKhMpMbKT1SooNrxHauzZ6Fe5K+xmXzoJHNwy8z3RQQi:nuyE5eQpZh3boojHauF4eY+cyyBi

Score
10/10
dogeratflubotandroidbankerdiscoveryevasioninfostealertrojan

Malware Config

Targets

    • Target

      8b116440dae67d7a258c225fd7770bfd

    • Size

      3.0MB

    • MD5

      8b116440dae67d7a258c225fd7770bfd

    • SHA1

      975d318bc82096c586913654e9f15ca643cfabd7

    • SHA256

      7dcb4c377eebc1d4c5efd5ef873d9d82fc0dcf1ed1ec7ce9884ca09341fc012e

    • SHA512

      b3f64e1532f030988daef21287fd52f9d1abf9a3fcad8eb5e8edbcabd47c1d413259b00f5c409221ded18ba66c5639df13245438369f5bbf20094fffeedc559e

    • SSDEEP

      49152:nhyfByEPmieQpAkKKhMpMbKT1SooNrxHauzZ6Fe5K+xmXzoJHNwy8z3RQQi:nuyE5eQpZh3boojHauF4eY+cyyBi

    Score
    10/10
    flubotbankerdiscoveryevasioninfostealertrojan

    • FluBot

      FluBot is an android banking trojan that uses overlays.

      bankertrojaninfostealerflubot

    • FluBot payload

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks