MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34d3338408dfd8244ba7ee655f558f0e06e0982cb76584f88707f6d0bdcf6a2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FluBot


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34d3338408dfd8244ba7ee655f558f0e06e0982cb76584f88707f6d0bdcf6a2c
SHA3-384 hash: 9397cc75d497eb81bc34073f2f1a435dd7c7c739606c3aa90adeed94a4a5ef1697170cbc40c91b00483f9067b95e2e0e
SHA1 hash: 452abfbc77dc37780b571d0ce4f623ac960d89ff
MD5 hash: 6a7e746ade78143f4ca2a7a4ce33f250
humanhash: lithium-vermont-yankee-montana
File name:DHL98.apk
Download: download sample
Signature FluBot
Create hunting rule
File size:2'778'048 bytes
First seen:2021-09-11 11:25:51 UTC
Last seen:2021-09-11 17:39:38 UTC
File type: apk
MIME type:application/zip
ssdeep 49152:uM7gzj8zOKPDuGpZ5pYklV4DM0qRNwjCRHeA3na98rjZHxcTngX3BH:utj8zOKrV/lV4DRpWRHhaQcTn6
TLSH T175D52209FE9FE017F103E1B5A164B98F850840498A88FE4B2A2D926C5DFBD449747FDE
Reporter Anonymous
Tags:apk FluBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
233
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Android.BankBot.9899.8713.1342.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/34d3338408dfd8244ba7ee655f558f0e06e0982cb76584f88707f6d0bdcf6a2c
Result
Threat name:
FluBot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/849142
Signature
Detected FluBot
Kills background processes
Might try to detect if ADB is running
Multi AV Scanner detection for submitted file
Uses accessibility services (likely to control other applications)
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34d3338408dfd8244ba7ee655f558f0e06e0982cb76584f88707f6d0bdcf6a2c/
Threat name:
Android.Dropper.Hqwar
Create hunting rule
Status:
Malicious
First seen:
2021-09-11 11:26:07 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  3/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
android obfuscation
Link:
https://tria.ge/reports/210911-njvt8sbcg8/
Behaviour
Uses reflection
Loads dropped Dex/Jar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FluBot

apk 34d3338408dfd8244ba7ee655f558f0e06e0982cb76584f88707f6d0bdcf6a2c

(this sample)

  
Delivery method
Distributed via web download

Comments