dogerat | 3057caca88807270b93142eb314755dec69d7cbe09fe7b9d78dce5e5c7ef4913

General

Target
JaffaCakes118_0334eba56e362dfa8c4aba3ee202624a
Size 3.0MB
Sample260515-tev74acy5t
SHA256 3057caca88807270b93142eb314755dec69d7cbe09fe7b9d78dce5e5c7ef4913
MD5 0334eba56e362dfa8c4aba3ee202624a
SHA1 acf7ded10113927a7077bffe50346d7a2387e971
SHA512 596e6c3d2a42bf90f30470cf69cfbe3c71a0420232539d4fab74dc9af5282c439dd8a49ea01ff2fd3286690dc9257c70849231179ce839d81326f966612de78e
SSDEEP 49152:DVmupryDHH0D6gmPOroTV8asMbUCRtNwaQut1xceJ62g1XSefUwKv2SC32p:DRrWn0DAOroTV87w8aBqB2etU4Sbp
TLSH
T1F1E52225FEAEE426D203E078B169D5879D044A0D4B08FA9F1B2591CC1EFAD44A743FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  JaffaCakes118_0334eba56e362dfa8c4aba3ee202624a
- Size 3.0MB
- SHA256 3057caca88807270b93142eb314755dec69d7cbe09fe7b9d78dce5e5c7ef4913
- MD5 0334eba56e362dfa8c4aba3ee202624a
- SHA1 acf7ded10113927a7077bffe50346d7a2387e971
- SHA512 596e6c3d2a42bf90f30470cf69cfbe3c71a0420232539d4fab74dc9af5282c439dd8a49ea01ff2fd3286690dc9257c70849231179ce839d81326f966612de78e
- SSDEEP 49152:DVmupryDHH0D6gmPOroTV8asMbUCRtNwaQut1xceJ62g1XSefUwKv2SC32p:DRrWn0DAOroTV87w8aBqB2etU4Sbp
- TLSH
  T1F1E52225FEAEE426D203E078B169D5879D044A0D4B08FA9F1B2591CC1EFAD44A743FDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion flubot infostealer persistence trojan
- Family: FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Requests enabling of the accessibility settings.
behavioral1