flubot | 2c66f415e9a038435b191446e2e56e0635ebb797a0db86babc4e148358c41bdb | Triage

Sharing

General

Target

2c66f415e9a038435b191446e2e56e0635ebb797a0db86babc4e148358c41bdb.zip
Size

3.7MB
Sample

250325-sek7fs1pt2
MD5

763063bd6fe3b0832eae584d289d0849
SHA1

c24dc0848a4dab6f4ee6670baecbf8fe6ceb4a67
SHA256

2c66f415e9a038435b191446e2e56e0635ebb797a0db86babc4e148358c41bdb
SHA512

7f6102ccb870df33d6fd8359bad87f9a13a8ef5fe6a8041af83a2d0fbc50b101cf15eb05bd8de28f1de2f96c480855e68684ebcabec487959acb0c094e68282d
SSDEEP

98304:Qc9/iSC2GmBoEOn9dFsenkKrLFYLE+8Qqgk5v:QGnC6BoxnOekK2AHQqgk5v

Score

10^/10

flubot android banker collection credential_access defense_evasion discovery evasion impact infostealer persistence trojan

Malware Config

Targets

- Target
  
  a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d.apk
- Size
  
  3.8MB
- MD5
  
  c23426edaf37a2fc6fc3a6e5daa17bfa
- SHA1
  
  a362e1aaf8bc7a7491b10eab252c3b7ee8532a46
- SHA256
  
  a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d
- SHA512
  
  98b78e62a63d87ddc55722658e85acb5f9ba4b792578ca8868e8214e04f4336e9728bec2c386b6afbac4f2183f8232d6e958b215c5c0948746f4254d32ffa2ff
- SSDEEP
  
  98304:e5bwkHNRfCwdA0cduVE7AxeQrUsVinobTdp6n:eFo0cdu+AxeMxTdwn
Score

10^/10

flubot banker collection credential_access defense_evasion discovery evasion impact infostealer persistence trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Flubot family
  flubot
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

System Network Connections Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Tasks

static1

behavioral1

flubotbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencetrojan

behavioral2

flubotbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencetrojan

behavioral3

flubotbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencetrojan