anubis | 328449250e95af61e5e92254665d4c1a43d835482cd2d159c1e8a08a1ad8c725

Analysis

max time kernel
4162366s
max time network
129s
platform
android_x86_64
resource
android-x86_64
submitted
24-11-2020 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af82bed2c58c403908faf323310cf6a65a7e3bfe098cc930eb5ac4bfe9315ef4.apk
Size

4.4MB
MD5

64b831a358118f5d8b20f4c5b78e8123
SHA1

acfbaf82579235d4e404875ac9bbb2b299f85f88
SHA256

af82bed2c58c403908faf323310cf6a65a7e3bfe098cc930eb5ac4bfe9315ef4
SHA512

4cc96bca1a539af4cdbd3928ea2e7ecc8d3eed4806a7a04c4e4e77830f891d9f889392cd819a16bfcacfb4a8ca77c6da5d35e02bfbb17facceb44bbce5f1e90c

Score

10^/10

anubis banker infostealer obfuscation stealth trojan

Malware Config

Extracted

Family

anubis

http://ktosdelaetskrintotpidor.com

http://sositehuypidarasi.com

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

mouse.celery.alone

pid process

3585 mouse.celery.alone

pid	process
3585	mouse.celery.alone

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

mouse.celery.alone

ioc	pid	process
/data/user/0/mouse.celery.alone/app_DynamicOptDex/Cbi.json	3585	mouse.celery.alone
/data/user/0/mouse.celery.alone/app_DynamicOptDex/Cbi.json	3585	mouse.celery.alone

Suspicious use of android.os.PowerManager$WakeLock.acquire 1 IoCs

Processes:

mouse.celery.alone

pid process

3585 mouse.celery.alone

pid	process
3585	mouse.celery.alone

Uses reflection 27 IoCs

obfuscation

Processes:

mouse.celery.alone

description	pid	process
Invokes method java.lang.Object.getClass	3585	mouse.celery.alone
Invokes method android.content.res.AssetManager.addAssetPath	3585	mouse.celery.alone
Invokes method android.app.ContextImpl.getAssets	3585	mouse.celery.alone
Invokes method java.lang.Object.getClass	3585	mouse.celery.alone
Invokes method android.content.res.AssetManager.open	3585	mouse.celery.alone
Invokes method java.io.FilterInputStream.read	3585	mouse.celery.alone
Invokes method java.io.FilterInputStream.read	3585	mouse.celery.alone
Invokes method java.io.BufferedInputStream.read	3585	mouse.celery.alone
Invokes method java.lang.Object.getClass	3585	mouse.celery.alone
Invokes method java.io.BufferedInputStream.close	3585	mouse.celery.alone
Invokes method java.lang.Object.getClass	3585	mouse.celery.alone
Invokes method java.lang.String.getBytes	3585	mouse.celery.alone
Invokes method java.lang.Object.getClass	3585	mouse.celery.alone
Invokes method java.io.FileOutputStream.write	3585	mouse.celery.alone
Invokes method java.lang.Object.getClass	3585	mouse.celery.alone
Invokes method java.io.BufferedInputStream.close	3585	mouse.celery.alone
Invokes method java.lang.Object.getClass	3585	mouse.celery.alone
Invokes method java.io.FilterOutputStream.close	3585	mouse.celery.alone
Invokes method android.app.ActivityThread.currentActivityThread	3585	mouse.celery.alone
Acesses field android.app.ActivityThread.mPackages	3585	mouse.celery.alone
Invokes method java.lang.reflect.Field.get	3585	mouse.celery.alone
Invokes method java.lang.Object.getClass	3585	mouse.celery.alone
Invokes method java.lang.ref.Reference.get	3585	mouse.celery.alone
Invokes method java.lang.ref.Reference.get	3585	mouse.celery.alone
Acesses field android.app.LoadedApk.mClassLoader	3585	mouse.celery.alone
Invokes method java.lang.reflect.Field.get	3585	mouse.celery.alone
Acesses field android.app.LoadedApk.mClassLoader	3585	mouse.celery.alone

mouse.celery.alone
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Suspicious use of android.os.PowerManager$WakeLock.acquire
- Uses reflection
PID:3585

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads