flubot | a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d

General

Target
a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d.apk
Size 3.8MB
Sample260817-sxcysstcnd
SHA256 a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d
MD5 c23426edaf37a2fc6fc3a6e5daa17bfa
SHA1 a362e1aaf8bc7a7491b10eab252c3b7ee8532a46
SHA512 98b78e62a63d87ddc55722658e85acb5f9ba4b792578ca8868e8214e04f4336e9728bec2c386b6afbac4f2183f8232d6e958b215c5c0948746f4254d32ffa2ff
SSDEEP 98304:e5bwkHNRfCwdA0cduVE7AxeQrUsVinobTdp6n:eFo0cdu+AxeMxTdwn
TLSH
T180062219BFAEE89BF007A23A9064A4C79408444D9908F95F3A23915C5EF7D447B83FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d.apk
- Size 3.8MB
- SHA256 a0181864eed9294cac0d278fa0eadabe68b3adb333eeb2e26cc082836f82489d
- MD5 c23426edaf37a2fc6fc3a6e5daa17bfa
- SHA1 a362e1aaf8bc7a7491b10eab252c3b7ee8532a46
- SHA512 98b78e62a63d87ddc55722658e85acb5f9ba4b792578ca8868e8214e04f4336e9728bec2c386b6afbac4f2183f8232d6e958b215c5c0948746f4254d32ffa2ff
- SSDEEP 98304:e5bwkHNRfCwdA0cduVE7AxeQrUsVinobTdp6n:eFo0cdu+AxeMxTdwn
- TLSH
  T180062219BFAEE89BF007A23A9064A4C79408444D9908F95F3A23915C5EF7D447B83FDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion flubot infostealer persistence trojan
- Family: FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
behavioral1