FluBot V4.9 Spreading across New Zealand
ID: 7b05e073-57d4-5fb1-80c8-f2a47053d8a7
STIX ID: report--7b05e073-57d4-5fb1-80c8-f2a47053d8a7
Feed Name: Cyble Blog
Threat Score
Cyble Research Labs analyzed a FluBot V4.9 Android banking trojan distributed via smishing in New Zealand; the report documents malicious capabilities (ACCESSIBILITY abuse, SEND/READ_SMS, READ_CONTACTS, notification interception, SMS replacement), use of a custom packer and embedded encrypted DEX, a DGA for C2 domain generation, RSA-encrypted C2 communications, command set and IOCs (SHA256 hashes and multiple C2 URLs), and provides mitigation guidance.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.