dogerat | 6323ac65167e8d48c3bd6c8b839eb600b5b9be9b942e582640147be8d98cedb6

General

Target
6323ac65167e8d48c3bd6c8b839eb600b5b9be9b942e582640147be8d98cedb6.apk
Size 2.6MB
Sample260817-brscvsdj2s
SHA256 6323ac65167e8d48c3bd6c8b839eb600b5b9be9b942e582640147be8d98cedb6
MD5 b65b16fb181011fdaf1fa4bcc22edf5b
SHA1 93c3c66ede2d13c5ec2325ee0f774a6808c0d7af
SHA512 6ea8a8c5ca4875707ac338236f9f945787a793ee125a41f8a4423d3e5b6339ddd8bf59432f17da5c1c98026001f797d0520b51bc0d16bafe68d931b202a10d76
SSDEEP 49152:w2mWPAlycYeV11r5N1SlVF4VyNHBn9bsTaU6KbN39kpkOwdWp8fAV6uXhDL9Iqq:Mdlkeb1r5aPFIkHxFs+49PcfVXhvu
TLSH
T1E3D51219FEAEE06AE14BD1319120D647D90C014F679CF65F6BA28A888EF7D448742FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

- Target
  6323ac65167e8d48c3bd6c8b839eb600b5b9be9b942e582640147be8d98cedb6.apk
- Size 2.6MB
- SHA256 6323ac65167e8d48c3bd6c8b839eb600b5b9be9b942e582640147be8d98cedb6
- MD5 b65b16fb181011fdaf1fa4bcc22edf5b
- SHA1 93c3c66ede2d13c5ec2325ee0f774a6808c0d7af
- SHA512 6ea8a8c5ca4875707ac338236f9f945787a793ee125a41f8a4423d3e5b6339ddd8bf59432f17da5c1c98026001f797d0520b51bc0d16bafe68d931b202a10d76
- SSDEEP 49152:w2mWPAlycYeV11r5N1SlVF4VyNHBn9bsTaU6KbN39kpkOwdWp8fAV6uXhDL9Iqq:Mdlkeb1r5aPFIkHxFs+49PcfVXhvu
- TLSH
  T1E3D51219FEAEE06AE14BD1319120D647D90C014F679CF65F6BA28A888EF7D448742FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion exfiltration flubot impact infostealer otp overlay persistence sms stealer trojan
- Family: FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Android SMS interception and OTP exfiltration
  Registers a high-priority SMS_RECEIVED receiver, parses inbound message bodies and aborts the broadcast to hide messages from the user, alongside network exfiltration primitives. This is the standard 2FA/OTP theft pattern used to complete fraudulent transactions.
  stealer sms otp
- Android banker: accessibility service abuse with overlay injection
  DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.
  banker trojan overlay
- Contact harvesting with SMS self-propagation
  Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.
  sms trojan exfiltration
- Notification listener abuse for OTP and message theft
  Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban
  stealer otp banker
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Requests changing the default SMS application.
  collection impact
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Requests enabling of the accessibility settings.
behavioral1 behavioral2 behavioral3