Analysis
- max time kernel
3866266s - max time network
162s - platform
android_x64 - resource
android-x64-20220310-en - submitted
21/05/2022, 11:25
Static task
static1
Behavioral task
behavioral1
Sample
e8962cfcd9e1533c59fddbe2f8126415989ce6646e2152306701187891eeccb4.apk
Resource
android-x86-arm-20220310-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e8962cfcd9e1533c59fddbe2f8126415989ce6646e2152306701187891eeccb4.apk
Resource
android-x64-20220310-en
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
e8962cfcd9e1533c59fddbe2f8126415989ce6646e2152306701187891eeccb4.apk
Resource
android-x64-arm64-20220310-en
0 signatures
0 seconds
General
- Target e8962cfcd9e1533c59fddbe2f8126415989ce6646e2152306701187891eeccb4.apk
- Size 3.2MB
- Sample220521-njgbvaghen
- SHA256 e8962cfcd9e1533c59fddbe2f8126415989ce6646e2152306701187891eeccb4
- MD5 404c1d266952d74b2942687a067ac8e1
- SHA1 5179f3543962ca704a622e6770a2d35ef9447e5e
- SHA512 ce707448ea2538ac3e53c6cdf8d6929f7f415c61b8e4767c94ae5601ea817e4269efd842eb85400a2001621f6a9e621aa83082967dff781a0844eee4784979e2
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Anubis banker
Android banker that uses overlays.
- Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/zcsbslkgerdndszjs.dcbpdsaprqqmwem.nnqhqoleyzwjkxexrwmcaq/app_DynamicOptDex/saap.json 6366 zcsbslkgerdndszjs.dcbpdsaprqqmwem.nnqhqoleyzwjkxexrwmcaq /data/user/0/zcsbslkgerdndszjs.dcbpdsaprqqmwem.nnqhqoleyzwjkxexrwmcaq/app_DynamicOptDex/saap.json 6366 zcsbslkgerdndszjs.dcbpdsaprqqmwem.nnqhqoleyzwjkxexrwmcaq - Reads information about phone network operator.
- Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener zcsbslkgerdndszjs.dcbpdsaprqqmwem.nnqhqoleyzwjkxexrwmcaq
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/zcsbslkgerdndszjs.dcbpdsaprqqmwem.nnqhqoleyzwjkxexrwmcaq/app_DynamicOptDex/saap.json
- Size 2.0MB
- SHA256 d764934d814dd206cbc4f686b0dfc07a41574ded16a9e61d820b76fa94b2f475
- MD5 8d992d131c0f3934c511ffb465998ba3
- SHA1 6d537fa77edf27fe0b9cb34b564e5848b6f5f625
- SHA512 0812975028d335fa0e55f4dbbbed02bb4330f0675ca222ba68adf3aa52a1e710a7b6d025cf2f50689b51c6dfaa3620f0e51ea76af464dc114e681d62cb0f244f
- SSDEEP 49152:ZNSTcYEkwJhj7+8aOvBxAH0x8vhAWWguNHXQ+Nes0xdQN3TR3/kz:ZNSTcYETJhji8RvBxAUyi3NTNxOK313g
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/zcsbslkgerdndszjs.dcbpdsaprqqmwem.nnqhqoleyzwjkxexrwmcaq/app_DynamicOptDex/saap.json
- Size 2.0MB
- SHA256 d1dd2605e4f6911d44c988d99ee46847cd55c705f56d11c250fba572c5ab56ba
- MD5 e286d8ee480263619467f7bd40e6df8e
- SHA1 d5e47be6e70482d007f1d75a7f39e709a4555666
- SHA512 34ba9584b7c46cf214b0644b765788ee7fbfe4746564791aab50f7ef48c84c16c1948cb6956240c271a484a84f8d4c7ee12fda49d71c6ae038bb7bc707a7541d
- SSDEEP 24576:ofwEOS6lvBxtXAXQXUX4HmcTyvv7XcE7p1eKqgAyR0Fo6MjozAplo:o4seB7K62Emc87p1edfpwWOa
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/zcsbslkgerdndszjs.dcbpdsaprqqmwem.nnqhqoleyzwjkxexrwmcaq/app_DynamicOptDex/saap.json
- Size 2.0MB
- SHA256 d1dd2605e4f6911d44c988d99ee46847cd55c705f56d11c250fba572c5ab56ba
- MD5 e286d8ee480263619467f7bd40e6df8e
- SHA1 d5e47be6e70482d007f1d75a7f39e709a4555666
- SHA512 34ba9584b7c46cf214b0644b765788ee7fbfe4746564791aab50f7ef48c84c16c1948cb6956240c271a484a84f8d4c7ee12fda49d71c6ae038bb7bc707a7541d
- SSDEEP 24576:ofwEOS6lvBxtXAXQXUX4HmcTyvv7XcE7p1eKqgAyR0Fo6MjozAplo:o4seB7K62Emc87p1edfpwWOa
- MD5 SHA1 SHA512 SSDEEP