flubot | 1a569aee63ca83bea22dd2f3cbe00dadcb1e5a1cf32be959890f0ccc8ad10e81 | Triage

Sharing

General

Target

1a569aee63ca83bea22dd2f3cbe00dadcb1e5a1cf32be959890f0ccc8ad10e81.zip
Size

3.2MB
Sample

250325-lxm1faxqs9
MD5

2f318d0553e9c37abb048d98473f7cca
SHA1

9cbd254230d75b622b6b44a976e392fda43b2967
SHA256

1a569aee63ca83bea22dd2f3cbe00dadcb1e5a1cf32be959890f0ccc8ad10e81
SHA512

7da2c749465d402f42eb003cf0119c2b959a9ddcde45158f03edb4f50d2cb8e129bf2ee200537daeae120c943cfac4d117c20b7880896d41d64252ac43bf9627
SSDEEP

49152:CaHeXKmp9PPzV5Wyym+8AVj3olhZuxag5BQUzMF/UXChC7PbRIXAH7/:CYY9x5LK3tx35BQUzMGXChsWXu7/

Score

10^/10

flubot android banker collection credential_access defense_evasion discovery evasion impact infostealer persistence trojan

Malware Config

Targets

- Target
  
  fc45b5f85cee56830a9f7e3001dca42026a9691445afa8f429b57203fc47a1b2.apk
- Size
  
  3.3MB
- MD5
  
  af9f032aecbb2c3a4f5eed9b5f675419
- SHA1
  
  a0ab0777891553d9c1dced5fdafe2b9e1d5b341e
- SHA256
  
  fc45b5f85cee56830a9f7e3001dca42026a9691445afa8f429b57203fc47a1b2
- SHA512
  
  abec508e52c01e4b2dd822d029629eb82304faba5b8f43c0cb3566f17490ef82e644ff5e270bcfdc595d49e81ca54d40e1c59341f659e5a66bf9f97792fbe2ed
- SSDEEP
  
  98304:Q7KGt3ZuI7y690JAD/oD4bSMI6/LTdCH93:QeGfuI7y2oDbV
Score

10^/10

flubot banker collection credential_access defense_evasion discovery evasion impact infostealer persistence trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Flubot family
  flubot
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

System Network Connections Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Tasks

static1

behavioral1

flubotbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencetrojan

behavioral2

flubotbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencetrojan

behavioral3

flubotbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencetrojan