flubot

General

Target
flubot_v4.9-4_7702b66e116d980cf047c8daf09418a8b0a01ce41ceb86f25cf51eb66d151096-first.apk
Size 5.5MB
Sample260219-nf17vadt9f
SHA256 7702b66e116d980cf047c8daf09418a8b0a01ce41ceb86f25cf51eb66d151096
MD5 1b7874952044ee26e5de47d88f43eaff
SHA1 51068918ef38de2582e3139c38020417764e6ec5
SHA512 f2446db4754aa81af6f61da1e4f71d174b5edc76f4f5a3ef313f9494cfdada85ecabf117a2ceae7503686d4916ba548712026fb5a8a839ce2504ca61dc6d3b45
SSDEEP 98304:t6vPTYPINSKhmONMO0Tb7qoC//gAhCqOcjIrjzrXo1ibYb3W3ECaVP9IvnarvWBe:tqPcQQNON8Tb7qX/gmZB0b+3PCEzYq5
TLSH
T1EF462328BEAED636E047D13CC268D44F6549146A4A08FE2B5A2D906C4EF7C44E706FDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  flubot_v4.9-4_7702b66e116d980cf047c8daf09418a8b0a01ce41ceb86f25cf51eb66d151096-first.apk
- Size 5.5MB
- SHA256 7702b66e116d980cf047c8daf09418a8b0a01ce41ceb86f25cf51eb66d151096
- MD5 1b7874952044ee26e5de47d88f43eaff
- SHA1 51068918ef38de2582e3139c38020417764e6ec5
- SHA512 f2446db4754aa81af6f61da1e4f71d174b5edc76f4f5a3ef313f9494cfdada85ecabf117a2ceae7503686d4916ba548712026fb5a8a839ce2504ca61dc6d3b45
- SSDEEP 98304:t6vPTYPINSKhmONMO0Tb7qoC//gAhCqOcjIrjzrXo1ibYb3W3ECaVP9IvnarvWBe:tqPcQQNON8Tb7qX/gmZB0b+3PCEzYq5
- TLSH
  T1EF462328BEAED636E047D13CC268D44F6549146A4A08FE2B5A2D906C4EF7C44E706FDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion flubot impact infostealer persistence trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Flubot family
  flubot
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
behavioral1 behavioral2 behavioral3