Loading malware…
FluBot is an Android banking trojan and botnet that emerged in 2020 and became one of the most active mobile cybercrime operations across Europe and other regions. It is also known as Cabassous and has been associated with package-delivery, voicemail, and similar social-engineering lures delivered primarily through SMS phishing campaigns. Victims are typically directed to malicious landing pages that impersonate trusted brands and persuade them to sideload a malicious Android application. FluBot campaigns have heavily targeted Spain, Germany, Italy, Poland, the United Kingdom, Australia, and other countries, with early activity notably affecting Spanish banking users.
Once installed, FluBot abuses Android Accessibility Services to obtain broad control over the device, including user-interface manipulation, automated approval of prompts, and disabling of security protections such as Google Play Protect. It is capable of stealing banking credentials through overlay attacks against legitimate financial applications, intercepting and hiding SMS messages, harvesting one-time passcodes, collecting contact lists and other personal information, and in some reporting logging keystrokes or screen text. FluBot also supports notification interception, app-target discovery, and retrieval of HTML injects for banking and cryptocurrency applications. Operators can use this access to facilitate account takeover and bypass SMS-based multifactor authentication.
A defining feature of FluBot is its self-propagation model. Infected devices exfiltrate contact lists and receive additional target data from command-and-control infrastructure, then send large volumes of smishing messages to new victims. Campaigns have used rapidly changing message templates, hacked websites as redirectors, and anti-filtering mutations to sustain distribution. Some operations reportedly harvested very large volumes of telephone numbers and infected tens of thousands of devices in Spain alone.
Technically, FluBot uses obfuscation, encrypted strings, packed or encrypted secondary payloads, and dynamic code loading to hinder analysis. Multiple analyses describe use of a domain generation algorithm for command-and-control discovery, with later variants evolving their communications model from direct HTTPS to DNS-based tunneling over HTTPS through public resolvers. The malware has also implemented anti-analysis and operational controls such as geo-targeting and bot verification before enabling full spam functionality.
FluBot has been advertised and rented in underground criminal ecosystems and has been linked to financially motivated operators rather than a state actor. Law-enforcement action in Spain led to arrests tied to distribution activity, but the malware continued to circulate afterward through other operators and affiliate-like distribution channels.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
According to our findings, this new operation (referred to as "FluBot") sets a new precedent for spreading methods and DGA implementations.
They have an arsenal of other commands available, including sending an SMS with content provided by the command and control (CnC).
The malware uses the multidex scheme to load the payload as secondary DEX... The technique consists in re-writing the way applications load multiple DEX.
In short, the malware abuses yet and again Android’s Accessibility Services. For example, to disable Play Protect, or display overlay windows to grab credit card info. But it also abuses the Accessibility Services for features I had not seen in other malware before like automatically accepting to send SMS messages.
In short, the malware abuses yet and again Android’s Accessibility Services. For example, to disable Play Protect, or display overlay windows to grab credit card info. But it also abuses the Accessibility Services for features I had not seen in other malware before like automatically accepting to send SMS messages.
The lure servers host a heavily obfuscated PHP file (e.g. called “[a-z].php”).
The com.tencent package name also tells us that the application has probably been packaged with the tencent packer.
So it seems that the malware authors repackaged the official WhatsApp app and added their malicious functionality.
After loading the DEX file, the malware deletes it from the file system to avoid leaving artifacts.
Most likely, the classes-v1.bin file gets decrypted and loaded in one of the static initialization blocks... after the sample has been run once, it actually doesn’t delete the decrypted dex file and simply keeps it in the app folder.
they’ve implemented a particularly interesting way to check if a new bot can send SMS and hence it isn’t a bot emulation
The websites check the browser’s user agent matches an Android platform, and won’t respond to other platforms
overlay fake login screens on top of official apps and collect users' credentials | the app uses the Android Accessibility service to overlay fake login screens on top of official apps and collect users' credentials
Based on the class names inside the com.tencent.mobileqq package we can see that the sample can: Perform overlay attacks ( BrowserActivity.class )... When the sample receives the list of applications to attack, it immediately begins sending the GET_INJECT command to get a HTML page for each targeted application.
they’ve implemented a particularly interesting way to check if a new bot can send SMS and hence it isn’t a bot emulation
overlay fake login screens on top of official apps and collect users' credentials | the app uses the Android Accessibility service to overlay fake login screens on top of official apps and collect users' credentials
Based on the class names inside the com.tencent.mobileqq package we can see that the sample can: Perform overlay attacks ( BrowserActivity.class )... When the sample receives the list of applications to attack, it immediately begins sending the GET_INJECT command to get a HTML page for each targeted application.
They have an arsenal of other commands available, including sending an SMS with content provided by the command and control (CnC).
The class that’s responsible for actually communicating with the C&C is the PanelReq class... There are a few methods involving encryption and decryption, but there’s also one method called ‘Send’ which takes two parameters and contains references to HTTP related classes.
A message instructs the target to download a third-party application by clicking a download button. As of September 2021, these downloads are either Flubot or in some cases Teabot.
According to our findings, this new operation (referred to as "FluBot") sets a new precedent for spreading methods and DGA implementations.
544 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as malware infrastructure subject to a Europol takedown operation; no additional functional details are provided in the excerpt.
FluBot is a banking trojan that spreads via fraudulent SMS messages and is known for stealing credentials and financial information from infected devices.
Referenced as a notable mobile banking malware family active in 2022 until its law-enforcement takedown at the end of May 2022.
Mobile malware/banking trojan highlighted as a notable threat and the subject of the year's only warning mentioned in the content.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.