flubot

General

Target
flubot_v4.9-3_9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9-first.apk
Size 5.0MB
Sample260219-neebpadt5g
SHA256 9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9
MD5 e6625c1492caa11ac4ea8e7039c423a2
SHA1 665cf567a24989208fb95b64f73a743f3b4f2470
SHA512 1e1df3c6b44acfb53b69e6b637a3524cad7ebc7d74f9d263de2f611ae1270f6ba5075eac494f5c2e57d1d230ab5b9f584265e18b46abbef9fcaf0674f166494e
SSDEEP 98304:qKr9rpz0mtVL4JV0O2XcYZDgPvlmDPdMpaBOdrDrXRjNG5q3W3f1As7eIwUEqRo:qKrFZtVLCb2Xd+PdmDVZBkJGk3Ts7e/9
TLSH
T197362329FE9EE196E10BD432E226E54785080059361CF92F1F26C68D6DBBC409B47FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  flubot_v4.9-3_9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9-first.apk
- Size 5.0MB
- SHA256 9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9
- MD5 e6625c1492caa11ac4ea8e7039c423a2
- SHA1 665cf567a24989208fb95b64f73a743f3b4f2470
- SHA512 1e1df3c6b44acfb53b69e6b637a3524cad7ebc7d74f9d263de2f611ae1270f6ba5075eac494f5c2e57d1d230ab5b9f584265e18b46abbef9fcaf0674f166494e
- SSDEEP 98304:qKr9rpz0mtVL4JV0O2XcYZDgPvlmDPdMpaBOdrDrXRjNG5q3W3f1As7eIwUEqRo:qKrFZtVLCb2Xd+PdmDVZBkJGk3Ts7e/9
- TLSH
  T197362329FE9EE196E10BD432E226E54785080059361CF92F1F26C68D6DBBC409B47FDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion flubot impact infostealer persistence trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Flubot family
  flubot
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
behavioral1 behavioral2 behavioral3