Overview

overview

10

Static

static

6

flubot_v4....st.apk

android-9-x86

10

flubot_v4....st.apk

android-10-x64

10

flubot_v4....st.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260129-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260129-enlocale:en-usos:android-9-x86system
  • submitted
    19/02/2026, 11:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    flubot_v4.9-3_9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9-first.apk
  • Size 5.0MB
  • Sample260219-neebpadt5g
  • SHA256 9d71e3a40bef2d3fb7f6efb165a9e08eba595eec85252604fb77ea824651f2e9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bankercollectioncredential_accessdefense_evasiondiscoveryevasionflubotimpactinfostealerpersistencetrojan

Malware Config

Signatures

  • FluBot

    FluBot is an android banking trojan that uses overlays.

    bankertrojaninfostealerflubot
  • FluBot payload 1 IoCs
  • Flubot family
    flubot
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.snda.wifilocating
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4189
    • /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.snda.wifilocating/d8hdJlI4Iy/hkhhuufuhhhxddf/base.apk.oggvf9e1.wlv --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.snda.wifilocating/d8hdJlI4Iy/hkhhuufuhhhxddf/oat/x86/base.apk.oggvf9e1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4218

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        tmp-base.apk.oggvf9e8921826657753287063.wlv
        • Path /data/data/com.snda.wifilocating/d8hdJlI4Iy/hkhhuufuhhhxddf/tmp-base.apk.oggvf9e8921826657753287063.wlv
        • Size 925KB
        • SHA256 1be3dd113c1276d42d350f46fe4901f570be922ca64fd6931d8ff49d577fc823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base.apk.oggvf9e1.wlv
        • Path /data/user/0/com.snda.wifilocating/d8hdJlI4Iy/hkhhuufuhhhxddf/base.apk.oggvf9e1.wlv
        • Size 2.0MB
        • SHA256 bb641c7fe70d53924208bb667fc0ed15ea51a5ce0a04127fe191d9b4d4ebb10f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download