flubot

General

Target
flubot_v4.9_831334e1e49ec7a25375562688543ee75b2b3cc7352afc019856342def52476b.apk
Size 4.8MB
Sample260219-nhmr8sdv4f
SHA256 831334e1e49ec7a25375562688543ee75b2b3cc7352afc019856342def52476b
MD5 c10d38a63e776e5940d281bddbb497d4
SHA1 ac0561ee9acc38c138409d03a24bdd992a5b1d96
SHA512 a9ddd9f1f370c0a15fc4f777ccd1bad8e2c3c6ad1236561fe8dc8e44690498e095fe86b755af68d43c14dc9a85cd0f9bbda452463e7dcad1e4bcdb2901ce3da5
SSDEEP 98304:5qBTEbLg6IcV1bVGgecr2uoyoqxQ7jjrXJ7dGK4z11GafG63W3KL:5BGcV1bVbjCuoyoqxIxGKk1QafN3BL
TLSH
T14B36231BBEDED01AD147D074D169D8678038450D6998FA3B2A6E84AC4AFAC45DB03FCF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  flubot_v4.9_831334e1e49ec7a25375562688543ee75b2b3cc7352afc019856342def52476b.apk
- Size 4.8MB
- SHA256 831334e1e49ec7a25375562688543ee75b2b3cc7352afc019856342def52476b
- MD5 c10d38a63e776e5940d281bddbb497d4
- SHA1 ac0561ee9acc38c138409d03a24bdd992a5b1d96
- SHA512 a9ddd9f1f370c0a15fc4f777ccd1bad8e2c3c6ad1236561fe8dc8e44690498e095fe86b755af68d43c14dc9a85cd0f9bbda452463e7dcad1e4bcdb2901ce3da5
- SSDEEP 98304:5qBTEbLg6IcV1bVGgecr2uoyoqxQ7jjrXJ7dGK4z11GafG63W3KL:5BGcV1bVbjCuoyoqxIxGKk1QafN3BL
- TLSH
  T14B36231BBEDED01AD147D074D169D8678038450D6998FA3B2A6E84AC4AFAC45DB03FCF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion flubot infostealer persistence trojan
- FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Flubot family
  flubot
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
behavioral1 behavioral2 behavioral3