flubot

General

Target

819e3a5b7126dc9d2dcfb670bc3cef1b5b19811c2ef9b43c4edeea4acd6b0ed0.zip
Size

4.8MB
Sample

250326-q9t2qsyjt8
MD5

7fb07b0d6a2545445bd89db3c639070f
SHA1

789071596eb1bcfe868a0c4db14c09526bb05a14
SHA256

819e3a5b7126dc9d2dcfb670bc3cef1b5b19811c2ef9b43c4edeea4acd6b0ed0
SHA512

aa52d88cdf92ddfbc7e1c04c92ea4fea7fc2a0f5a2f36d05dab03cc88d5d6b71e9d320751b55b8d5094675bd3e5cee1279d92efb5103e4c8b361e8ec1a608f92
SSDEEP

98304:7tCn97PGhVMuZrcyBEe7ChFKJHUqcQJonpG9ZV7yzxNq9O:7tC97PGhVbZwc7ChFKuqdIG9ZByzV

Score

10^/10

Malware Config

Targets

- Target
  
  df5944f9190614f04a8818a50438dfaf3339fa95289cdc0af54f8f239eb253fd.apk
- Size
  
  5.0MB
- MD5
  
  749510b3010a45fea2d2763476e17511
- SHA1
  
  79589fd0ba7c1d0afc8c3d1e22ed60a38585348e
- SHA256
  
  df5944f9190614f04a8818a50438dfaf3339fa95289cdc0af54f8f239eb253fd
- SHA512
  
  b98e95c300068d9273a0e8143f2c9fec31abd8d806cd653dc83ed580a07bda1de6d442a0540e4db5a0abd86dbfd67f012aa6fdcc0ac1b6e9803b0c65bc11c3e4
- SSDEEP
  
  98304:4mamSQUaXwpaqhRikhoWQafbXrXmZg5uQ+1xNGbFF8Djc13W3EAe:9SQUaXPSG9q5P+7NGbr8Ds3v
Score

10^/10

flubot banker collection credential_access defense_evasion discovery evasion impact infostealer persistence trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Flubot family
  flubot
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
behavioral1 behavioral2 behavioral3