flubot

General

Target

39c7ad6f0f5bea15001dfa01c337a9db44de0582d41bda87d5507c3bf453d73c.bin
Size

3.3MB
Sample

240225-1ya5laec5z
MD5

ba633174df329bbb08e12a8c74203306
SHA1

de6b3f2a977aeaaecf335de60d390056ed8d24ab
SHA256

39c7ad6f0f5bea15001dfa01c337a9db44de0582d41bda87d5507c3bf453d73c
SHA512

30f780c531ae0431c05dbe17a86fba86c8b42c479381b70cb95c777ef7a312deb50270d8db721ab475df2b2334459f87e2223406e328132887c92e56d9f4d477
SSDEEP

98304:YTEk6iXsxRB912taAW1CFUdl+D32whoFQO/G6:YYkyRBWDW1IUdl+7hKe6

Score

10^/10

Malware Config

Targets

- Target
  
  39c7ad6f0f5bea15001dfa01c337a9db44de0582d41bda87d5507c3bf453d73c.bin
- Size
  
  3.3MB
- MD5
  
  ba633174df329bbb08e12a8c74203306
- SHA1
  
  de6b3f2a977aeaaecf335de60d390056ed8d24ab
- SHA256
  
  39c7ad6f0f5bea15001dfa01c337a9db44de0582d41bda87d5507c3bf453d73c
- SHA512
  
  30f780c531ae0431c05dbe17a86fba86c8b42c479381b70cb95c777ef7a312deb50270d8db721ab475df2b2334459f87e2223406e328132887c92e56d9f4d477
- SSDEEP
  
  98304:YTEk6iXsxRB912taAW1CFUdl+D32whoFQO/G6:YYkyRBWDW1IUdl+7hKe6
Score

10^/10

flubot banker collection discovery evasion infostealer trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Requests enabling of the accessibility settings.
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Tasks

Sharing

General

Malware Config

Targets

FluBot payload

Makes use of the framework's Accessibility service

Loads dropped Dex/Jar

Requests enabling of the accessibility settings.

Creates a large amount of network flows

Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3