flubot | ea6776fac45c8844242fdb566a17e70569813298235567bbe9fa0dd062f1160b | Triage

Sharing

General

Target

891d5d2c397e9ad5fed5685f78657d4b_JaffaCakes118
Size

4.6MB
Sample

240402-lm1tjsda2x
MD5

891d5d2c397e9ad5fed5685f78657d4b
SHA1

f2f3f6344e054a03cd83e2e2f00af2af3d59f1c5
SHA256

ea6776fac45c8844242fdb566a17e70569813298235567bbe9fa0dd062f1160b
SHA512

369875e4359b91936f015d347be0f765ffdfddb92c82d887d3cbe07c38dacc0029b25f38682f270700feaa62d728ccf42ccd95362785f7c2119ae43e74d2ac49
SSDEEP

98304:UHIuiDQ9wfSVdDp6gDkTjhJfB5oxlAuEk0Olk0mYjFpfYgQ+Q67D2t:Uor4pVZp6PjbfskXX+3PQd67O

Score

10^/10

flubot android banker collection discovery evasion infostealer persistence trojan

Malware Config

Targets

- Target
  
  891d5d2c397e9ad5fed5685f78657d4b_JaffaCakes118
- Size
  
  4.6MB
- MD5
  
  891d5d2c397e9ad5fed5685f78657d4b
- SHA1
  
  f2f3f6344e054a03cd83e2e2f00af2af3d59f1c5
- SHA256
  
  ea6776fac45c8844242fdb566a17e70569813298235567bbe9fa0dd062f1160b
- SHA512
  
  369875e4359b91936f015d347be0f765ffdfddb92c82d887d3cbe07c38dacc0029b25f38682f270700feaa62d728ccf42ccd95362785f7c2119ae43e74d2ac49
- SSDEEP
  
  98304:UHIuiDQ9wfSVdDp6gDkTjhJfB5oxlAuEk0Olk0mYjFpfYgQ+Q67D2t:Uor4pVZp6PjbfskXX+3PQd67O
Score

10^/10

flubot banker collection discovery evasion infostealer persistence trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Input Injection

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

flubotbankercollectiondiscoveryevasioninfostealerpersistencetrojan

behavioral2

flubotbankercollectiondiscoveryevasioninfostealerpersistencetrojan

behavioral3

flubotbankercollectiondiscoveryevasioninfostealerpersistencetrojan