Skip to content

Hide Navigation Hide TOC

FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc)

FluBot is a multi-purpose mobile banking malware that was first observed in Spain in late 2020. It primarily spread through European countries using a variety of SMS phishing messages in multiple languages.(Citation: proofpoint_flubot_0421)(Citation: bitdefender_flubot_0524)

Cluster A Galaxy A Cluster B Galaxy B Level
GUI Input Capture - T1417.002 (4c58b7c6-a839-4789-bda9-9de33e4d4512) Attack Pattern FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc) Malware 1
SMS Messages - T1636.004 (c6421411-ae61-42bb-9098-73fddb315002) Attack Pattern FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc) Malware 1
Asymmetric Cryptography - T1521.002 (16d73b64-5681-4ea0-9af4-4ad86f7c96e8) Attack Pattern FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc) Malware 1
Prevent Application Removal - T1629.001 (dc01774a-d1c1-45fb-b506-0a5d1d6593d9) Attack Pattern FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc) Malware 1
Domain Generation Algorithms - T1637.001 (fd211238-f767-4599-8c0d-9dca36624626) Attack Pattern FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc) Malware 1
Disable or Modify Tools - T1629.003 (2aa78dfd-cb6f-4c70-9408-137cfd96be49) Attack Pattern FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc) Malware 1
User Evasion - T1628.002 (24a77e53-0751-46fc-b207-99378fb35c08) Attack Pattern FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc) Malware 1
Contact List - T1636.003 (e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86) Attack Pattern FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc) Malware 1
FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc) Malware Exfiltration Over C2 Channel - T1646 (32063d7f-0a39-440d-a4a3-2694488f96cc) Attack Pattern 1
Access Notifications - T1517 (39dd7871-f59b-495f-a9a5-3cb8cc50c9b2) Attack Pattern FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc) Malware 1
Web Protocols - T1437.001 (2282a98b-5049-4f61-9381-55baca7c1add) Attack Pattern FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc) Malware 1
SMS Control - T1582 (b327a9c0-e709-495c-aa6e-00b042136e2b) Attack Pattern FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc) Malware 1
Proxy Through Victim - T1604 (5ca3c7ec-55b2-4587-9376-cf6c96f8047a) Attack Pattern FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc) Malware 1
FluBot - S1067 (f5ff006c-702f-4ded-8e60-ca6c540d91bc) Malware Obfuscated Files or Information - T1406 (d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a) Attack Pattern 1
GUI Input Capture - T1417.002 (4c58b7c6-a839-4789-bda9-9de33e4d4512) Attack Pattern Input Capture - T1417 (a8c31121-852b-46bd-9ba4-674ae5afe7ad) Attack Pattern 2
Protected User Data - T1636 (11c2c2b7-1fd4-408f-bc2e-fe772ef9df5e) Attack Pattern SMS Messages - T1636.004 (c6421411-ae61-42bb-9098-73fddb315002) Attack Pattern 2
Asymmetric Cryptography - T1521.002 (16d73b64-5681-4ea0-9af4-4ad86f7c96e8) Attack Pattern Encrypted Channel - T1521 (ed2c05a1-4f81-4d97-9e1b-aff01c34ae84) Attack Pattern 2
Prevent Application Removal - T1629.001 (dc01774a-d1c1-45fb-b506-0a5d1d6593d9) Attack Pattern Impair Defenses - T1629 (20b0931a-8952-42ca-975f-775bad295f1a) Attack Pattern 2
Dynamic Resolution - T1637 (2ccc3d39-9598-4d32-9657-42e1c7095d26) Attack Pattern Domain Generation Algorithms - T1637.001 (fd211238-f767-4599-8c0d-9dca36624626) Attack Pattern 2
Disable or Modify Tools - T1629.003 (2aa78dfd-cb6f-4c70-9408-137cfd96be49) Attack Pattern Impair Defenses - T1629 (20b0931a-8952-42ca-975f-775bad295f1a) Attack Pattern 2
User Evasion - T1628.002 (24a77e53-0751-46fc-b207-99378fb35c08) Attack Pattern Hide Artifacts - T1628 (fc53309d-ebd5-4573-9242-57024ebdad4f) Attack Pattern 2
Protected User Data - T1636 (11c2c2b7-1fd4-408f-bc2e-fe772ef9df5e) Attack Pattern Contact List - T1636.003 (e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86) Attack Pattern 2
Application Layer Protocol - T1437 (6a3f6490-9c44-40de-b059-e5940f246673) Attack Pattern Web Protocols - T1437.001 (2282a98b-5049-4f61-9381-55baca7c1add) Attack Pattern 2