flubot

General

Target

ac773cd2c075d4ad82659d9eaa369155
Size

3.3MB
Sample

240228-v8t3kaaa33
MD5

ac773cd2c075d4ad82659d9eaa369155
SHA1

6bc377e4a3e6e95ca74928837e3cced108cb625e
SHA256

2b26c52922e8d4f07e948f13970025d62c0d96bd0fe6802d0567fd2c73b94392
SHA512

d672521118ff3811d53f4ec72ef7c8807564d1fc0106c1a3e47106e5ec009589b16845bf4cbae0cf3fd26404fd1bbc0d48f7406a0632c107feee4b4d05efece7
SSDEEP

98304:utQGt3ZuI7y690JAD/oD4Itdl6/LTdCHwY:uCGfuI7y2oDRZ

Score

10^/10

Malware Config

Targets

- Target
  
  ac773cd2c075d4ad82659d9eaa369155
- Size
  
  3.3MB
- MD5
  
  ac773cd2c075d4ad82659d9eaa369155
- SHA1
  
  6bc377e4a3e6e95ca74928837e3cced108cb625e
- SHA256
  
  2b26c52922e8d4f07e948f13970025d62c0d96bd0fe6802d0567fd2c73b94392
- SHA512
  
  d672521118ff3811d53f4ec72ef7c8807564d1fc0106c1a3e47106e5ec009589b16845bf4cbae0cf3fd26404fd1bbc0d48f7406a0632c107feee4b4d05efece7
- SSDEEP
  
  98304:utQGt3ZuI7y690JAD/oD4Itdl6/LTdCHwY:uCGfuI7y2oDRZ
Score

10^/10

flubot banker collection discovery evasion infostealer trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Tasks

Sharing

General

Malware Config

Targets

FluBot payload

Creates a large amount of network flows

Makes use of the framework's Accessibility service

Loads dropped Dex/Jar

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3