anubis | d2ad6d2b364b5984d7762c29eccfab703e6107cb8abca25f338822326710e399 | Triage™

Analysis

max time kernel
36829s
max time network
113s
platform
android_x64
resource
android-x64-arm64
submitted
16/02/2022, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2ad6d2b364b5984d7762c29eccfab703e6107cb8abca25f338822326710e399 (1).apk
Size 286KB
Sample220216-m3wefabfb2
SHA256 d2ad6d2b364b5984d7762c29eccfab703e6107cb8abca25f338822326710e399
MD5 291405335fbaf6581517fff2ac25d9a6
SHA1 8b6bc161e1a184e957471d220efd4446356d48de
SHA512 c5d3222ceb84117e131cf6d135ad976e5e81e75ca12f0899482665699b44e021780719ac18e01a5652afbcf3178113bc65d00a2e3aea5ea3063f3409a22bdb25
MD5 SHA1 SHA512

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	wocwvy.czyxoxmbauu.slsa

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	wocwvy.czyxoxmbauu.slsa

wocwvy.czyxoxmbauu.slsa
1⤵
- Makes use of the framework's Accessibility service.
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:5528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads