Loading malware…
FluBot is an Android banking trojan and botnet active since late 2020 that spread primarily through large-scale smishing campaigns. It commonly impersonates parcel delivery, voicemail, Android update, and similar service-themed lures to trick users into sideloading malicious Android applications from fake landing pages. The malware became especially prominent in Spain before expanding across Europe, Australia, and parts of Asia, and has also been referred to as Cabassous and FedEx Banker.
On infected devices, FluBot abuses Android Accessibility Services to obtain broad control over the user interface and device actions. It steals banking credentials through overlay and web-injection techniques, captures SMS messages and one-time passcodes, accesses contact lists, and exfiltrates personal and device information to command-and-control infrastructure. Reported variants can send, intercept, hide, and delete SMS messages, manipulate notifications, disable Google Play Protect, log screen text or keystroke-like input via accessibility abuse, and in some reporting provide operators with near full remote control of the device. FluBot also targets cryptocurrency-related applications in some campaigns.
A defining feature of FluBot is self-propagation through infected devices. It harvests contacts and telephone numbers, receives additional target lists from its operators, and sends high-volume smishing messages to new victims. Operators frequently rotate lure themes, message templates, and distribution infrastructure to evade filtering and sustain campaigns. FluBot has used hacked websites and Android-only landing pages to deliver malicious APKs, and some campaigns verified that newly infected bots could successfully send SMS before assigning them live propagation tasks.
Technically, FluBot uses obfuscation, encrypted strings, packed or encrypted secondary payloads, and dynamically loaded DEX components to hinder analysis. It employs a domain generation algorithm for command-and-control discovery and evolved from direct encrypted communications to DNS-over-HTTPS and DNS-based tunneling in later versions. Documented command capabilities include contact and SMS collection, SMS propagation, overlay retrieval, notification interception, opening URLs, uninstall-related actions, and remote configuration updates. Later variants added features such as direct notification replies, cookie theft or session-related web data theft, and MMS-based smishing.
FluBot has been widely associated with financially motivated cybercrime activity rather than a single publicly established state actor. It has been advertised and rented in underground criminal ecosystems, and law-enforcement actions in Spain and later multinational disruption efforts targeted parts of its distribution and infrastructure. Despite takedowns and arrests, FluBot remained one of the most significant Android banking malware families of its period because of its scale, rapid iteration, and effective contact-driven propagation model.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
According to our findings, this new operation (referred to as "FluBot") sets a new precedent for spreading methods and DGA implementations.
They have an arsenal of other commands available, including sending an SMS with content provided by the command and control (CnC).
The malware uses the multidex scheme to load the payload as secondary DEX... The technique consists in re-writing the way applications load multiple DEX.
In short, the malware abuses yet and again Android’s Accessibility Services. For example, to disable Play Protect, or display overlay windows to grab credit card info. But it also abuses the Accessibility Services for features I had not seen in other malware before like automatically accepting to send SMS messages.
In short, the malware abuses yet and again Android’s Accessibility Services. For example, to disable Play Protect, or display overlay windows to grab credit card info. But it also abuses the Accessibility Services for features I had not seen in other malware before like automatically accepting to send SMS messages.
The lure servers host a heavily obfuscated PHP file (e.g. called “[a-z].php”).
The com.tencent package name also tells us that the application has probably been packaged with the tencent packer.
So it seems that the malware authors repackaged the official WhatsApp app and added their malicious functionality.
After loading the DEX file, the malware deletes it from the file system to avoid leaving artifacts.
Most likely, the classes-v1.bin file gets decrypted and loaded in one of the static initialization blocks... after the sample has been run once, it actually doesn’t delete the decrypted dex file and simply keeps it in the app folder.
they’ve implemented a particularly interesting way to check if a new bot can send SMS and hence it isn’t a bot emulation
The websites check the browser’s user agent matches an Android platform, and won’t respond to other platforms
the app uses the Android Accessibility service to overlay fake login screens on top of official apps and collect users' credentials | overlay fake login screens on top of official apps and collect users' credentials
Based on the class names inside the com.tencent.mobileqq package we can see that the sample can: Perform overlay attacks ( BrowserActivity.class )... When the sample receives the list of applications to attack, it immediately begins sending the GET_INJECT command to get a HTML page for each targeted application.
they’ve implemented a particularly interesting way to check if a new bot can send SMS and hence it isn’t a bot emulation
the app uses the Android Accessibility service to overlay fake login screens on top of official apps and collect users' credentials | overlay fake login screens on top of official apps and collect users' credentials
Based on the class names inside the com.tencent.mobileqq package we can see that the sample can: Perform overlay attacks ( BrowserActivity.class )... When the sample receives the list of applications to attack, it immediately begins sending the GET_INJECT command to get a HTML page for each targeted application.
They have an arsenal of other commands available, including sending an SMS with content provided by the command and control (CnC).
The class that’s responsible for actually communicating with the C&C is the PanelReq class... There are a few methods involving encryption and decryption, but there’s also one method called ‘Send’ which takes two parameters and contains references to HTTP related classes.
A message instructs the target to download a third-party application by clicking a download button. As of September 2021, these downloads are either Flubot or in some cases Teabot.
According to our findings, this new operation (referred to as "FluBot") sets a new precedent for spreading methods and DGA implementations.
544 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
46 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as malware infrastructure subject to a Europol takedown operation; no additional functional details are provided in the excerpt.
FluBot is a banking trojan that spreads via fraudulent SMS messages and is known for stealing credentials and financial information from infected devices.
Referenced as a notable mobile banking malware family active in 2022 until its law-enforcement takedown at the end of May 2022.
Mobile malware/banking trojan highlighted as a notable threat and the subject of the year's only warning mentioned in the content.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.