anubis | 5557bc7744bf58f6acf6331c4e82e6bd61396a28d764dc45602f4d7b9af2c971

Analysis

max time kernel
4022989s
max time network
82s
platform
android_x86_64
resource
android-x86_64_arm64
submitted
20-04-2021 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5557bc7744bf58f6acf6331c4e82e6bd61396a28d764dc45602f4d7b9af2c971.apk
Size

4.0MB
MD5

08026567e556b15bc73b994d2e62e54b
SHA1

287c7a28b62a4f0a1fc0cb1cdc84d591149bdc08
SHA256

5557bc7744bf58f6acf6331c4e82e6bd61396a28d764dc45602f4d7b9af2c971
SHA512

0c35fcf6486bf0162fc352aaf8f026a1efee55dfa5ec7eefa78d671a037bd2ada34168383035a4fe0b02e5917378b9fcc0898088de80a2e40c828808e8ef29d2

Score

10^/10

anubis banker infostealer obfuscation stealth trojan

Malware Config

Extracted

Family

anubis

http://ktosdelaetskrintotpidor.com

http://sositehuypidarasi.com

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

oil.ride.setup

pid process

4418 oil.ride.setup

pid	process
4418	oil.ride.setup

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

oil.ride.setup

ioc	pid	process
/data/user/0/oil.ride.setup/app_DynamicOptDex/mWtQuO.json	4418	oil.ride.setup
/data/user/0/oil.ride.setup/app_DynamicOptDex/mWtQuO.json	4418	oil.ride.setup

Requests enabling of the accessibility settings. 1 IoCs

Processes:

oil.ride.setup

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS oil.ride.setup

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	oil.ride.setup

Uses reflection 27 IoCs

obfuscation

Processes:

oil.ride.setup

description	pid	process
Invokes method java.lang.Object.getClass	4418	oil.ride.setup
Invokes method android.content.res.AssetManager.addAssetPath	4418	oil.ride.setup
Invokes method android.app.ContextImpl.getAssets	4418	oil.ride.setup
Invokes method java.lang.Object.getClass	4418	oil.ride.setup
Invokes method android.content.res.AssetManager.open	4418	oil.ride.setup
Invokes method java.io.FilterInputStream.read	4418	oil.ride.setup
Invokes method java.io.FilterInputStream.read	4418	oil.ride.setup
Invokes method java.io.BufferedInputStream.read	4418	oil.ride.setup
Invokes method java.lang.Object.getClass	4418	oil.ride.setup
Invokes method java.io.BufferedInputStream.close	4418	oil.ride.setup
Invokes method java.lang.Object.getClass	4418	oil.ride.setup
Invokes method java.lang.String.getBytes	4418	oil.ride.setup
Invokes method java.lang.Object.getClass	4418	oil.ride.setup
Invokes method java.io.FileOutputStream.write	4418	oil.ride.setup
Invokes method java.lang.Object.getClass	4418	oil.ride.setup
Invokes method java.io.BufferedInputStream.close	4418	oil.ride.setup
Invokes method java.lang.Object.getClass	4418	oil.ride.setup
Invokes method java.io.FilterOutputStream.close	4418	oil.ride.setup
Invokes method android.app.ActivityThread.currentActivityThread	4418	oil.ride.setup
Acesses field android.app.ActivityThread.mPackages	4418	oil.ride.setup
Invokes method java.lang.reflect.Field.get	4418	oil.ride.setup
Invokes method java.lang.Object.getClass	4418	oil.ride.setup
Invokes method java.lang.ref.Reference.get	4418	oil.ride.setup
Invokes method java.lang.ref.Reference.get	4418	oil.ride.setup
Acesses field android.app.LoadedApk.mClassLoader	4418	oil.ride.setup
Invokes method java.lang.reflect.Field.get	4418	oil.ride.setup
Acesses field android.app.LoadedApk.mClassLoader	4418	oil.ride.setup

oil.ride.setup
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Uses reflection
PID:4418

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads