flubot | d1340ed4d24a213ba11b01cc35341c101b25f2317cff99093f428152a2fc634e

General

Target
d1340ed4d24a213ba11b01cc35341c101b25f2317cff99093f428152a2fc634e.apk
Size 3.8MB
Sample260818-ztlvvsbd86
SHA256 d1340ed4d24a213ba11b01cc35341c101b25f2317cff99093f428152a2fc634e
MD5 1378457ca7e2373c450c9422eb9ca866
SHA1 8dbe6385738c51819a9834611eb415f1eea9afab
SHA512 7da8b609557b6b140cec3b06089e5140c019e2164f139d68ca57b81aa8ef5af44a13c4cd48b95f61f66d1f9d295f18d209926f65c192a386e09d422761b08264
SSDEEP 98304:zmWywxtERg3J0i4eGsuTDXYoLaJWfqY1Lv:zmfEaPeGsuTjY7Y1Lv
TLSH
T14406231DFEAEE426E007F539D1E4958B5808849C4E46FA0B1A35928C4EFBD44A707FDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  d1340ed4d24a213ba11b01cc35341c101b25f2317cff99093f428152a2fc634e.apk
- Size 3.8MB
- SHA256 d1340ed4d24a213ba11b01cc35341c101b25f2317cff99093f428152a2fc634e
- MD5 1378457ca7e2373c450c9422eb9ca866
- SHA1 8dbe6385738c51819a9834611eb415f1eea9afab
- SHA512 7da8b609557b6b140cec3b06089e5140c019e2164f139d68ca57b81aa8ef5af44a13c4cd48b95f61f66d1f9d295f18d209926f65c192a386e09d422761b08264
- SSDEEP 98304:zmWywxtERg3J0i4eGsuTDXYoLaJWfqY1Lv:zmfEaPeGsuTjY7Y1Lv
- TLSH
  T14406231DFEAEE426E007F539D1E4958B5808849C4E46FA0B1A35928C4EFBD44A707FDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion exfiltration flubot impact infostealer otp overlay persistence sms stealer trojan
- Family: FluBot
  FluBot is an android banking trojan that uses overlays.
  banker trojan infostealer flubot
- FluBot payload
- Custom signature
  
  Android SMS interception and OTP exfiltration
  Registers a high-priority SMS_RECEIVED receiver, parses inbound message bodies and aborts the broadcast to hide messages from the user, alongside network exfiltration primitives. This is the standard 2FA/OTP theft pattern used to complete fraudulent transactions.
  stealer sms otp
- Custom signature
  
  Android banker: accessibility service abuse with overlay injection
  DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.
  banker trojan overlay
- Custom signature
  
  Contact harvesting with SMS self-propagation
  Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.
  sms trojan exfiltration
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Custom signature
  
  Notification listener abuse for OTP and message theft
  Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban
  stealer otp banker
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Requests changing the default SMS application.
  collection impact
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Requests enabling of the accessibility settings.
behavioral1 behavioral2 behavioral3