flubot | c4290560c6776b09f188deb80d27250bddaae123c201ac29391be4aef523f48d

General

Target
c4290560c6776b09f188deb80d27250bddaae123c201ac29391be4aef523f48d.apk
Size 4.2MB
Sample260818-yd5glaygmb
SHA256 c4290560c6776b09f188deb80d27250bddaae123c201ac29391be4aef523f48d
MD5 8b6c4905f8f93af27e60b502621e03f6
SHA1 5e5afc1c4cb35a5c2236ee75caba1fd062079c2f
SHA512 e53ac001ad16641b58debb254e79696ae8883f60a7ad2fc74ead3473b85e5082acf649f97992a8af7f0abb309f599a12b5e63594b9f8169367648b9535c4b10a
SSDEEP 98304:VuI2jB0TbH87hFHKC+dcmGhQZC34dfbZjhwmWm8WLtkh+I:VuvV4buHd+dzGhT3GbZGVWLtkcI
TLSH
T18E162317FE9EE026D433E179D2699A47440A441A0A08FE1BAE27535C4EFBD409B43FED
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

- Target
  c4290560c6776b09f188deb80d27250bddaae123c201ac29391be4aef523f48d.apk
- Size 4.2MB
- SHA256 c4290560c6776b09f188deb80d27250bddaae123c201ac29391be4aef523f48d
- MD5 8b6c4905f8f93af27e60b502621e03f6
- SHA1 5e5afc1c4cb35a5c2236ee75caba1fd062079c2f
- SHA512 e53ac001ad16641b58debb254e79696ae8883f60a7ad2fc74ead3473b85e5082acf649f97992a8af7f0abb309f599a12b5e63594b9f8169367648b9535c4b10a
- SSDEEP 98304:VuI2jB0TbH87hFHKC+dcmGhQZC34dfbZjhwmWm8WLtkh+I:VuvV4buHd+dzGhT3GbZGVWLtkcI
- TLSH
  T18E162317FE9EE026D433E179D2699A47440A441A0A08FE1BAE27535C4EFBD409B43FED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion exfiltration flubot infostealer otp overlay persistence sms stealer trojan
- Family: FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Custom signature
  
  Android SMS interception and OTP exfiltration
  Registers a high-priority SMS_RECEIVED receiver, parses inbound message bodies and aborts the broadcast to hide messages from the user, alongside network exfiltration primitives. This is the standard 2FA/OTP theft pattern used to complete fraudulent transactions.
  stealer sms otp
- Custom signature
  
  Android banker: accessibility service abuse with overlay injection
  DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.
  banker trojan overlay
- Custom signature
  
  Contact harvesting with SMS self-propagation
  Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.
  sms trojan exfiltration
- Custom signature
  
  Notification listener abuse for OTP and message theft
  Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban
  stealer otp banker
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
behavioral1 behavioral2 behavioral3