Flubot - Pandemic in Our Pockets
summary
Android banking trojan Flubot (aka Cabazos) spreads by SMS from infected phones using contacts stolen from victims and WordPress drop sites and hits Finland hard in fall 2021. It adopts DNS over HTTPS C2 using Google Cloudflare and Alibaba, tunnels base32 TXT blobs, and uses an RC4 key wrapped with a hard coded RSA key. Samples use per‑sample custom packing and string XOR decryption, generate 2,500 domains via a DGA (seed 1945 by default), request accessibility overlay and intercept SMS/notifications while uploading contacts and enabling SOCKS remote access.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:12Flubot aka: Cabassous
- 6:20Highlights from version history
- 8:22Packing and obfuscation Mitre T1027
- 12:05Let's take a closer look Android Manifest.xml
- 16:00Combine information and write a script
- 18:10Flubot uses shared preferences
- 19:22Calling home
- 21:07DGA Domain Generation Algorithm
- 24:57How C2 tunneling works?
- 26:40The query
- 27:16C2 commands
- 27:48Not all system languages are equal
- 28:19Whitelisted system languages
- 28:30Target countries by country codes All are western countries
- 29:06Financial goal Phishing overlays
- 29:56Conclusion
related talks
51mMoney Doesn't Stink - Cybercriminal Business Insight of A New Android Botnet
56mCybersecurity & Privacy From The Global Lens
44mBeyond Desktops: The Rise and Transformation of Mobile Malware
19mHacking Like Da Vinci
33mSMS PVA Services Fueled by Compromised Supply-Chain Mobile Botnets
30mReversing Mobile Malware
57m(In)Security of Mobile Banking
37mYour Phone is Not Your Phone: A Dive Into SMS PVA Fraud