Fluhorse: recovered C2 indicators & analysis

What Fluhorse is

Fluhorse (also written FluHorse) is an Android malware family publicly documented by Check Point Research in early May 2023, with observed campaign activity traced back to at least May 2022. It targets users in Eastern Asia and is distributed through phishing: victims, including high-profile targets, receive emails urging them to resolve a payment issue and are directed to a phishing website from which they download a malicious APK. The fake apps impersonate legitimate, widely installed applications, most notably an ETC electronic toll-collection app used in Taiwan and the VPBank Neo banking app used in Vietnam; additional variants have mimicked a transportation service and dating apps aimed at Chinese-speaking users.

Once installed, the app presents a fake login or payment form that captures the victim's account credentials and, in banking/toll variants, credit-card details. It requests SMS-related permissions and then intercepts incoming text messages, forwarding them to an attacker-controlled server so that operators can capture two-factor-authentication (2FA) codes and defeat SMS-based verification. Reporting notes that after harvesting data the app often shows a 'system is busy' style waiting message for several minutes, buying time for the operators to use the stolen credentials and intercepted codes.

A distinguishing characteristic is that Fluhorse's malicious logic is implemented in Dart using Google's Flutter cross-platform framework, with the malicious functionality embedded directly in the Flutter/Dart code rather than in conventional Android/Java components. Researchers highlighted that Flutter's runtime and custom VM made the samples harder to analyze and helped some samples evade detection for extended periods. A later variant analyzed by Fortinet added an AES-128-CBC packing layer (with a hard-coded key and IV) decrypted at the native level via OpenSSL's EVP API, wrapping a Dart package named 'sms_flutter'.

Command-and-control and exfiltration are performed over HTTP(S) using POST requests to server endpoints. Check Point documented paths such as /addcontent (credentials), /addcontent2 (payment-card data), and /addcontent3 (forwarded SMS content); Fortinet observed the SMS body sent as a URL parameter (e.g., 'c4') to an /addcontent3 endpoint. The observed C2 protocol is essentially one-directional data exfiltration from the device to the server; no rich set of remotely issued device commands has been documented for this family.

Capabilities

• Masquerades as legitimate, popular apps (e.g., ETC toll app in Taiwan, VPBank Neo in Vietnam)
• Distributed via phishing emails linking to fake websites that serve a malicious APK
• Steals account login credentials via fake in-app login forms
• Steals credit-card / payment data in banking and toll variants
• Requests SMS permissions and intercepts incoming SMS messages
• Captures SMS-delivered 2FA/OTP codes to bypass two-factor authentication
• Exfiltrates stolen data to attacker command-and-control servers over HTTP(S) POST
• Implemented in Dart/Flutter with malicious logic embedded in Flutter code to hinder analysis
• Later variant uses AES-128-CBC native packing (hard-coded key/IV) to obstruct static analysis
• Displays a fake 'system busy' waiting screen while operators use the stolen data

Known C2 / channel types: HTTP(S) POST / REST-style exfiltration endpoints (e.g., /addcontent, /addcontent2, /addcontent3).

MITRE ATT&CK (Mobile)

Techniques commonly associated with Fluhorse:

What Privara Unmask recovered

The C2 host was recovered from the sample's configuration. The endpoint was not contacted at runtime (dormant/offline infrastructure); the indicator is the recovered host identity. The analysis ran on a de-emulated Android 17 device that the sample could not fingerprint as virtual, so it behaved as it would on a real handset.

Indicators of compromise (IOCs)

External references

• Eastern Asian Android Assault - FluHorse
  Check Point Research
• FluHorse - Check Point Research Exposes Newly Discovered Malware Disguised as Legitimate and Popular Android Apps Targeting East Asia
  Check Point Blog
• Fortinet Reverses Flutter-based Android Malware "Fluhorse"
  Fortinet FortiGuard Labs
• New Android FluHorse malware steals your passwords, 2FA codes
  BleepingComputer
• New Android Malware 'FluHorse' Targeting East Asian Markets with Deceptive Tactics
  The Hacker News

Methodology & honest limits

This sample was obtained from MalwareBazaar and detonated in a controlled, isolated environment. C2 identity was recovered from the executing sample and its configuration. We report only what the analysis established: an offline sample yields a C2 identity, not a live beacon, and we say so. Nothing here is inferred beyond the evidence.