Loading malware…
FluBot, also known as Cabassous and FedEx Banker, is an Android banking trojan operated through a botnet of compromised mobile devices. It targets banking and cryptocurrency application users, with campaigns spanning Spain, Germany, the United Kingdom, other European countries, Australia, and Japan. Multiple cybercriminal distributor groups have used the malware, which has been advertised and rented through underground forums.
FluBot primarily spreads through smishing messages impersonating parcel-delivery services, voicemail notifications, software updates, and other familiar services. These messages direct recipients to deceptive landing pages that persuade them to sideload malicious Android applications. Compromised websites, including WordPress sites, have served as redirectors and delivery infrastructure. Infected devices upload their contact lists and send further malicious SMS messages to contacts and additional recipients supplied by command-and-control servers, supporting rapid propagation.
The malware abuses Android Accessibility Services to manipulate the user interface, capture keystrokes and screen text, display fraudulent HTML overlays over legitimate banking and cryptocurrency applications, and disable Google Play Protect. It steals banking credentials, payment-card information, contacts, SMS messages, one-time passcodes, and other personal data. Its device-control and SMS-interception capabilities enable operators to bypass SMS-based authentication and conduct financial fraud. FluBot also inventories installed applications to obtain appropriate overlays from its command-and-control infrastructure.
FluBot uses encrypted payloads, dynamic DEX loading, string obfuscation, and application packing to impede analysis. Its command-and-control infrastructure uses a domain generation algorithm and encrypted communications; later versions introduced DNS tunneling over HTTPS through public resolvers. Distribution campaigns employ rapidly changing links, mutated SMS templates, geographic filtering, and bot-verification mechanisms to hinder filtering and investigation.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
According to our findings, this new operation (referred to as "FluBot") sets a new precedent for spreading methods and DGA implementations.
They have an arsenal of other commands available, including sending an SMS with content provided by the command and control (CnC).
The malware uses the multidex scheme to load the payload as secondary DEX... The technique consists in re-writing the way applications load multiple DEX.
In short, the malware abuses yet and again Android’s Accessibility Services. For example, to disable Play Protect, or display overlay windows to grab credit card info. But it also abuses the Accessibility Services for features I had not seen in other malware before like automatically accepting to send SMS messages.
In short, the malware abuses yet and again Android’s Accessibility Services. For example, to disable Play Protect, or display overlay windows to grab credit card info. But it also abuses the Accessibility Services for features I had not seen in other malware before like automatically accepting to send SMS messages.
The lure servers host a heavily obfuscated PHP file (e.g. called “[a-z].php”).
The com.tencent package name also tells us that the application has probably been packaged with the tencent packer.
So it seems that the malware authors repackaged the official WhatsApp app and added their malicious functionality.
After loading the DEX file, the malware deletes it from the file system to avoid leaving artifacts.
Most likely, the classes-v1.bin file gets decrypted and loaded in one of the static initialization blocks... after the sample has been run once, it actually doesn’t delete the decrypted dex file and simply keeps it in the app folder.
they’ve implemented a particularly interesting way to check if a new bot can send SMS and hence it isn’t a bot emulation
The websites check the browser’s user agent matches an Android platform, and won’t respond to other platforms
overlay fake login screens on top of official apps and collect users' credentials | the app uses the Android Accessibility service to overlay fake login screens on top of official apps and collect users' credentials
Based on the class names inside the com.tencent.mobileqq package we can see that the sample can: Perform overlay attacks ( BrowserActivity.class )... When the sample receives the list of applications to attack, it immediately begins sending the GET_INJECT command to get a HTML page for each targeted application.
they’ve implemented a particularly interesting way to check if a new bot can send SMS and hence it isn’t a bot emulation
overlay fake login screens on top of official apps and collect users' credentials | the app uses the Android Accessibility service to overlay fake login screens on top of official apps and collect users' credentials
Based on the class names inside the com.tencent.mobileqq package we can see that the sample can: Perform overlay attacks ( BrowserActivity.class )... When the sample receives the list of applications to attack, it immediately begins sending the GET_INJECT command to get a HTML page for each targeted application.
They have an arsenal of other commands available, including sending an SMS with content provided by the command and control (CnC).
The class that’s responsible for actually communicating with the C&C is the PanelReq class... There are a few methods involving encryption and decryption, but there’s also one method called ‘Send’ which takes two parameters and contains references to HTTP related classes.
A message instructs the target to download a third-party application by clicking a download button. As of September 2021, these downloads are either Flubot or in some cases Teabot.
According to our findings, this new operation (referred to as "FluBot") sets a new precedent for spreading methods and DGA implementations.
544 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
48 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as malware infrastructure subject to a Europol takedown operation; no additional functional details are provided in the excerpt.
FluBot is a banking trojan that spreads via fraudulent SMS messages and is known for stealing credentials and financial information from infected devices.
Referenced as a notable mobile banking malware family active in 2022 until its law-enforcement takedown at the end of May 2022.
Mobile malware/banking trojan highlighted as a notable threat and the subject of the year's only warning mentioned in the content.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.