Analysis
- max time kernel
3889081s - max time network
74s - platform
android_x86_64 - resource
android-x86-avd2 - submitted
13/08/2020, 12:08
Static task
static1
Behavioral task
behavioral1
Sample
d906bc2b169d8c6d09a1eb2b77ec4d29e636b65ce6749a4b241d0eeecf8233ce.apk
Resource
android-x86-avd2
android_x86_64
0 signatures
0 seconds
General
- Target d906bc2b169d8c6d09a1eb2b77ec4d29e636b65ce6749a4b241d0eeecf8233ce.apk
- Size 4.4MB
- Sample200813-4lvta3ab2x
- SHA256 d906bc2b169d8c6d09a1eb2b77ec4d29e636b65ce6749a4b241d0eeecf8233ce
- MD5 1ffad8d6ef29d16ec0af0eb2101020dd
- SHA1 5921b61814a1a130f58bc9e5f5513c1ceb049715
- SHA512 0d1c925af6588176fa695d04bd5f0432b6ad8dd550af8caf1e5c3544cfa9c5f986a167babdf13ba0fb1f1c48f82ded9197a53af9a76a299c7e666c1869523890
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
anubis
C2
-
http://ktosdelaetskrintotpidor.com
-
http://sositehuypidarasi.com
Signatures
- Anubis banker
Android banker that uses overlays.
-
pid Process 4643 com.arfyfcarh.kvumuikybf - Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.arfyfcarh.kvumuikybf/app_files/isgdakavox.jar 4643 com.arfyfcarh.kvumuikybf - Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
description ioc Process Framework API call android.telephony.TelephonyManager.getNetworkOperatorName com.arfyfcarh.kvumuikybf - Suspicious use of android.app.ActivityManager.getRunningServices 39 IoCs
pid Process 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf 4643 com.arfyfcarh.kvumuikybf - Suspicious use of android.os.PowerManager$WakeLock.acquire 1 IoCs
pid Process 4643 com.arfyfcarh.kvumuikybf - Suspicious use of android.telephony.TelephonyManager.getLine1Number 1 IoCs
pid Process 4643 com.arfyfcarh.kvumuikybf - Suspicious use of android.telephony.TelephonyManager.getNetworkCountryIso 1 IoCs
pid Process 4643 com.arfyfcarh.kvumuikybf - Uses reflection 133 IoCs
description pid Process Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method android.content.ContextWrapper.getBaseContext 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method android.app.ContextImpl.getDir 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.io.File.getAbsolutePath 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method android.content.ContextWrapper.getAssets 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method android.content.res.AssetManager.openNonAssetFd 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method android.content.res.AssetFileDescriptor.createInputStream 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method android.content.res.AssetFileDescriptor$AutoCloseInputStream.read 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.System.arraycopy 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method android.content.res.AssetFileDescriptor$AutoCloseInputStream.read 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.System.arraycopy 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.System.arraycopy 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method android.content.res.AssetFileDescriptor$AutoCloseInputStream.read 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.System.arraycopy 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method android.content.res.AssetFileDescriptor$AutoCloseInputStream.read 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.System.arraycopy 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.System.arraycopy 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.forName 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getConstructor 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.Constructor.newInstance 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.io.FileOutputStream.write 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.io.FileOutputStream.close 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getClassLoader 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.forName 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.forName 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getConstructor 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.Constructor.newInstance 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getDeclaredField 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.forName 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getDeclaredField 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Acesses field java.lang.Boolean.TRUE 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.Field.get 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.AccessibleObject.setAccessible 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Acesses field android.app.ContextImpl.mPackageInfo 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.Field.get 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getDeclaredField 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.forName 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getDeclaredField 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Acesses field java.lang.Boolean.TRUE 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.Field.get 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.AccessibleObject.setAccessible 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Acesses field android.app.LoadedApk.mClassLoader 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.Field.set 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.forName 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getConstructor 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.Constructor.newInstance 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.io.File.delete 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.forName 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getConstructor 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.Constructor.newInstance 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.io.File.delete 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.ClassLoader.loadClass 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.forName 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method android.app.Instrumentation.newApplication 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getDeclaredField 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.forName 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getDeclaredField 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Acesses field java.lang.Boolean.TRUE 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.Field.get 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.AccessibleObject.setAccessible 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Acesses field android.app.ContextImpl.mPackageInfo 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.Field.get 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getDeclaredField 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.forName 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getDeclaredField 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Acesses field java.lang.Boolean.TRUE 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.Field.get 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.AccessibleObject.setAccessible 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Acesses field android.app.LoadedApk.mApplication 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.reflect.Field.set 4643 com.arfyfcarh.kvumuikybf Invokes method java.lang.Class.getMethods 4643 com.arfyfcarh.kvumuikybf Invokes method com.arfyfcarh.kvumuikybf.zdzyRxEziq.onCreate 4643 com.arfyfcarh.kvumuikybf Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 4643 com.arfyfcarh.kvumuikybf
Processes
-
com.arfyfcarh.kvumuikybf1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads name of network operator
- Suspicious use of android.app.ActivityManager.getRunningServices
- Suspicious use of android.os.PowerManager$WakeLock.acquire
- Suspicious use of android.telephony.TelephonyManager.getLine1Number
- Suspicious use of android.telephony.TelephonyManager.getNetworkCountryIso
- Uses reflection
PID:4643