flubot

General

Target

c23426edaf37a2fc6fc3a6e5daa17bfa
Size

3.8MB
Sample

240312-cqal4adc7x
MD5

c23426edaf37a2fc6fc3a6e5daa17bfa
SHA1

a362e1aaf8bc7a7491b10eab252c3b7ee8532a46
SHA256

a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d
SHA512

98b78e62a63d87ddc55722658e85acb5f9ba4b792578ca8868e8214e04f4336e9728bec2c386b6afbac4f2183f8232d6e958b215c5c0948746f4254d32ffa2ff
SSDEEP

98304:e5bwkHNRfCwdA0cduVE7AxeQrUsVinobTdp6n:eFo0cdu+AxeMxTdwn

Score

10^/10

Malware Config

Targets

- Target
  
  c23426edaf37a2fc6fc3a6e5daa17bfa
- Size
  
  3.8MB
- MD5
  
  c23426edaf37a2fc6fc3a6e5daa17bfa
- SHA1
  
  a362e1aaf8bc7a7491b10eab252c3b7ee8532a46
- SHA256
  
  a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d
- SHA512
  
  98b78e62a63d87ddc55722658e85acb5f9ba4b792578ca8868e8214e04f4336e9728bec2c386b6afbac4f2183f8232d6e958b215c5c0948746f4254d32ffa2ff
- SSDEEP
  
  98304:e5bwkHNRfCwdA0cduVE7AxeQrUsVinobTdp6n:eFo0cdu+AxeMxTdwn
Score

10^/10

flubot banker collection discovery evasion infostealer trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Input Injection

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Tasks

Sharing

General

Malware Config

Targets

FluBot payload

Makes use of the framework's Accessibility service

Loads dropped Dex/Jar

Creates a large amount of network flows

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3