flubot

General

Target
a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d
Size 3.8MB
Sample240313-pcvrbsed43
SHA256 a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d
MD5 c23426edaf37a2fc6fc3a6e5daa17bfa
SHA1 a362e1aaf8bc7a7491b10eab252c3b7ee8532a46
SHA512 98b78e62a63d87ddc55722658e85acb5f9ba4b792578ca8868e8214e04f4336e9728bec2c386b6afbac4f2183f8232d6e958b215c5c0948746f4254d32ffa2ff
SSDEEP 98304:e5bwkHNRfCwdA0cduVE7AxeQrUsVinobTdp6n:eFo0cdu+AxeMxTdwn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d
- Size 3.8MB
- SHA256 a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d
- MD5 c23426edaf37a2fc6fc3a6e5daa17bfa
- SHA1 a362e1aaf8bc7a7491b10eab252c3b7ee8532a46
- SHA512 98b78e62a63d87ddc55722658e85acb5f9ba4b792578ca8868e8214e04f4336e9728bec2c386b6afbac4f2183f8232d6e958b215c5c0948746f4254d32ffa2ff
- SSDEEP 98304:e5bwkHNRfCwdA0cduVE7AxeQrUsVinobTdp6n:eFo0cdu+AxeMxTdwn
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

flubot banker collection discovery evasion infostealer trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Input Injection

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Tasks

Sharing

General

Malware Config

Targets

FluBot payload

Makes use of the framework's Accessibility service

Loads dropped Dex/Jar

Creates a large amount of network flows

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3