MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d62843e7064553f995bb97b3e064922ebc93ac6591112f9b58b11b51c5ca8b30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FluBot


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d62843e7064553f995bb97b3e064922ebc93ac6591112f9b58b11b51c5ca8b30
SHA3-384 hash: ddec1d4895d6f32f322fb6c70d9b7774834604093bc477e90c973bbf97ec73491cfc808bedbe26b80876d75da978b053
SHA1 hash: 37470bd54c24ec5b42ee982bcd8df2f6255f3fa9
MD5 hash: 7aa3538e663b6f580f821a9b345ec187
humanhash: princess-delta-spring-blossom
File name:DHL25.apk
Download: download sample
Signature FluBot
Create hunting rule
File size:2'778'048 bytes
First seen:2021-09-07 11:48:32 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 49152:4mVRrmFXYEjfe1JVBm8V/nHNtENwbGO0Lav9QMmqW8bvtDEf3RW:4MrKZbSJVBdV/HTDb7P1QzsLtqW
TLSH T110D51295FEAEE51AD103E134D164D8839608444CC988FB6F1A3A914E5EFBC44AB07FDE
Reporter _TripleE_
Tags:apk FluBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
217
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/d62843e7064553f995bb97b3e064922ebc93ac6591112f9b58b11b51c5ca8b30
Result
Threat name:
FluBot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/846584
Signature
Detected FluBot
Drops a new APK file
Kills background processes
Might try to detect if ADB is running
Multi AV Scanner detection for submitted file
Uses accessibility services (likely to control other applications)
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d62843e7064553f995bb97b3e064922ebc93ac6591112f9b58b11b51c5ca8b30/
Threat name:
Android.Dropper.Hqwar
Create hunting rule
Status:
Malicious
First seen:
2021-09-07 11:49:07 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  3/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
android obfuscation
Link:
https://tria.ge/reports/210907-ny1n2acea2/
Behaviour
Uses reflection
Loads dropped Dex/Jar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments