Loading malware…
FluBot, originally tracked as Cabassous, is an Android banking trojan and botnet first observed in late 2020. It initially targeted users in Spain and later expanded across multiple European countries and Japan through large-scale SMS phishing campaigns that impersonated parcel and delivery services. Victims were lured into installing malicious Android applications presented as package-tracking or delivery-related apps, after which the malware harvested contacts and propagated by sending further smishing messages from infected devices.
FluBot is designed to steal credentials and facilitate fraud against mobile banking and cryptocurrency users. It uses overlay attacks, including fake login screens delivered through Android WebView, to impersonate targeted banking and wallet applications. It also intercepts and sends SMS messages, steals contact lists, can open attacker-specified pages, and has been reported to disable security protections, execute USSD requests, uninstall applications, and provide SOCKS proxy functionality. In some campaigns it delivered target lists tailored to the victim’s country.
Operationally, FluBot stood out for rapid iterative development, use of a domain generation algorithm for command-and-control resilience, and encrypted bot-to-server communications that complicated takeover attempts. Later samples used multiple DGA seeds to improve scalability. The malware was heavily associated with international smishing operations using delivery-themed lures such as DHL and UPS. Researchers and industry reporting widely converged on the name FluBot after the family was initially identified as Cabassous. Law-enforcement action in Spain temporarily disrupted the botnet in 2021, but activity resumed shortly afterward, indicating continued operator capability and ongoing maintenance.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
users receive an SMS message with the question "Is this you in this video?" and are tricked into clicking a link that installs the malware.
Families like Anatsa and Cabassous spread to thousands of victims by international SMiShing campaigns, coupled with various kinds of web phishing pages to trick users into downloading malicious APKs.
The classes use string obfuscation, control flow obfuscation and many of the decompilers are unable to decompile entire sections of the obfuscated classes.
The com.tencent package name also tells us that the application has probably been packaged with the tencent packer.
So it seems that the malware authors repackaged the official WhatsApp app and added their malicious functionality.
Most likely, the classes-v1.bin file gets decrypted and loaded in one of the static initialization blocks... after the sample has been run once, it actually doesn’t delete the decrypted dex file and simply keeps it in the app folder.
overlay fake login screens on top of official apps and collect users' credentials | the app uses the Android Accessibility service to overlay fake login screens on top of official apps and collect users' credentials
Based on the class names inside the com.tencent.mobileqq package we can see that the sample can: Perform overlay attacks ( BrowserActivity.class )... When the sample receives the list of applications to attack, it immediately begins sending the GET_INJECT command to get a HTML page for each targeted application.
overlay fake login screens on top of official apps and collect users' credentials | the app uses the Android Accessibility service to overlay fake login screens on top of official apps and collect users' credentials
Based on the class names inside the com.tencent.mobileqq package we can see that the sample can: Perform overlay attacks ( BrowserActivity.class )... When the sample receives the list of applications to attack, it immediately begins sending the GET_INJECT command to get a HTML page for each targeted application.
The malware would collect banking credentials and send the data back to its command and control server.
The class that’s responsible for actually communicating with the C&C is the PanelReq class... There are a few methods involving encryption and decryption, but there’s also one method called ‘Send’ which takes two parameters and contains references to HTTP related classes.
On April 18th, Cabassous began to use multiple DGA seeds in every sample allowing it to be more scalable: the Trojan generates corresponding C2 server address
163 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a comparative example of malware abandoning overlays in favor of browser-based credential theft.
Mentioned only as background context about earlier Android banking malware activity.
Mentioned only as an example of malware naming confusion and aliases.
Mentioned only as an example of malware naming confusion and aliases.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.