Analysis
-
max time kernel
3887622s -
max time network
31s -
platform
android_x86_64 -
resource
android-x86-avd2 -
submitted
13-08-2020 12:07
Static task
static1
Behavioral task
behavioral1
Sample
0e33a0200df97e40d691d6f57749ac9584652f832c28fd8ad017154b5f9db2b3.apk
Resource
android-x86-avd2
android_x86_64
0 signatures
0 seconds
General
-
Target
0e33a0200df97e40d691d6f57749ac9584652f832c28fd8ad017154b5f9db2b3.apk
-
Size
5.3MB
-
MD5
b35433e70c0e1db86caecef39a2dd7ed
-
SHA1
86a66462090f01e42fed28a70c9b34035ea6bec8
-
SHA256
0e33a0200df97e40d691d6f57749ac9584652f832c28fd8ad017154b5f9db2b3
-
SHA512
d880d1fb2433c9c6310779deee1cdcca525176cc551c4cb55044caf7bf1e80d82aba9eb4d171ca1a27b11fa54cf7b8775b88d6eeabe3da090bc65b4733c230e7
Score
10/10
Malware Config
Extracted
Family
anubis
C2
http://ktosdelaetskrintotpidor.com
http://sositehuypidarasi.com
Signatures
-
Anubis banker
Android banker that uses overlays.
-
pid Process 5188 com.mwurawatnafa.ryvrlda -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.mwurawatnafa.ryvrlda/app_files/kmqbjcu.jar 5188 com.mwurawatnafa.ryvrlda -
Suspicious use of android.app.ActivityManager.getRunningServices 7 IoCs
pid Process 5188 com.mwurawatnafa.ryvrlda 5188 com.mwurawatnafa.ryvrlda 5188 com.mwurawatnafa.ryvrlda 5188 com.mwurawatnafa.ryvrlda 5188 com.mwurawatnafa.ryvrlda 5188 com.mwurawatnafa.ryvrlda 5188 com.mwurawatnafa.ryvrlda -
Suspicious use of android.os.PowerManager$WakeLock.acquire 1 IoCs
pid Process 5188 com.mwurawatnafa.ryvrlda -
Uses reflection 132 IoCs
description pid Process Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method android.content.ContextWrapper.getBaseContext 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method android.app.ContextImpl.getDir 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.io.File.getAbsolutePath 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method android.content.ContextWrapper.getAssets 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method android.content.res.AssetManager.openNonAssetFd 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method android.content.res.AssetFileDescriptor.createInputStream 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method android.content.res.AssetFileDescriptor$AutoCloseInputStream.read 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.System.arraycopy 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method android.content.res.AssetFileDescriptor$AutoCloseInputStream.read 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.System.arraycopy 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.System.arraycopy 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method android.content.res.AssetFileDescriptor$AutoCloseInputStream.read 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.System.arraycopy 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method android.content.res.AssetFileDescriptor$AutoCloseInputStream.read 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.System.arraycopy 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.System.arraycopy 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.forName 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getConstructor 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.Constructor.newInstance 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.io.FileOutputStream.write 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.io.FileOutputStream.close 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getClassLoader 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.forName 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.forName 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getConstructor 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.Constructor.newInstance 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getDeclaredField 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.forName 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getDeclaredField 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Acesses field java.lang.Boolean.TRUE 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.Field.get 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.AccessibleObject.setAccessible 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Acesses field android.app.ContextImpl.mPackageInfo 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.Field.get 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getDeclaredField 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.forName 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getDeclaredField 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Acesses field java.lang.Boolean.TRUE 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.Field.get 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.AccessibleObject.setAccessible 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Acesses field android.app.LoadedApk.mClassLoader 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.Field.set 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.forName 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getConstructor 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.Constructor.newInstance 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.io.File.delete 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.forName 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getConstructor 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.Constructor.newInstance 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.io.File.delete 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.ClassLoader.loadClass 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.forName 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method android.app.Instrumentation.newApplication 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getDeclaredField 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.forName 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getDeclaredField 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Acesses field java.lang.Boolean.TRUE 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.Field.get 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.AccessibleObject.setAccessible 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Acesses field android.app.ContextImpl.mPackageInfo 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.Field.get 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getDeclaredField 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.forName 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getDeclaredField 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Acesses field java.lang.Boolean.TRUE 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.Field.get 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.AccessibleObject.setAccessible 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Acesses field android.app.LoadedApk.mApplication 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.reflect.Field.set 5188 com.mwurawatnafa.ryvrlda Invokes method java.lang.Class.getMethods 5188 com.mwurawatnafa.ryvrlda Invokes method com.mwurawatnafa.ryvrlda.EhTEFRYq.onCreate 5188 com.mwurawatnafa.ryvrlda