Analysis
-
max time kernel
3868499s -
max time network
133s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
21-05-2022 11:28
Static task
static1
Behavioral task
behavioral1
Sample
5e5e52f820cccad6d98561d004f6c7d892586e45b569f24b72596b9132940b98.apk
Resource
android-x86-arm-20220310-en
Behavioral task
behavioral2
Sample
5e5e52f820cccad6d98561d004f6c7d892586e45b569f24b72596b9132940b98.apk
Resource
android-x64-20220310-en
Behavioral task
behavioral3
Sample
5e5e52f820cccad6d98561d004f6c7d892586e45b569f24b72596b9132940b98.apk
Resource
android-x64-arm64-20220310-en
General
-
Target
5e5e52f820cccad6d98561d004f6c7d892586e45b569f24b72596b9132940b98.apk
-
Size
3.1MB
-
MD5
a5fb657df3fe76ae6557bf4c38b05f36
-
SHA1
cb61617c688c2c1d214c9922537bffb16eb4f0bf
-
SHA256
5e5e52f820cccad6d98561d004f6c7d892586e45b569f24b72596b9132940b98
-
SHA512
3c60a1e2c009358a78da46b98e9e38c50c60da30459af8e7a6cc94ecf1c9ed662abe80ec17eb53bf1d416025b2a5fbcee10a5830dfe2b61f8bca5968db3b309d
Malware Config
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Makes use of the framework's Accessibility service. 3 IoCs
Processes:
fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyecadescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca -
Acquires the wake lock. 1 IoCs
Processes:
fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyecadescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/IjuGXW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/oat/x86/IjuGXW.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/IjuGXW.json 5107 fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca /data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/IjuGXW.json 5191 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/IjuGXW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/oat/x86/IjuGXW.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/IjuGXW.json 5107 fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca -
Reads information about phone network operator.
-
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
Processes:
fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyecadescription ioc process Framework API call android.hardware.SensorManager.registerListener fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca
Processes
-
fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/IjuGXW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/oat/x86/IjuGXW.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/IjuGXW.jsonFilesize
1.9MB
MD54be06f9af32cbf9cf49c70a01536d4bb
SHA13e8fb2a09da938bed8fe42555d7f88cb9fb0eb63
SHA256ad27515d802299423aeed425b557c9a56c3a765e08e68a1f79d28e19fec5d0be
SHA5125474372c16959c677402d41db0046c8b83ba0c101ab0ea1e930e3fcb730e1d2e8c1de76d737e3289e8b392d5f8b306a2b168ad20714c63b86e0c2d243446621c
-
/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/IjuGXW.jsonFilesize
1.9MB
MD5e6ae9c9e091a4573d4805b0e74b2269d
SHA119cc603c447634257534cdbe70468975992e9be9
SHA2563b4f9f978c6667d8f729ea17799cd477151afe0899bbd231be2895dbd14fec9a
SHA512a1ee2c1168119bf0684f097907403490707586bd7d76a5de16560e9863bec9dcd948045f55696ba95aae248fe5843ec4fbaf7f0c8b29aa9962e2f22c9bea228c
-
/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/IjuGXW.jsonFilesize
1.9MB
MD5dac859cd020ba7684f06a9255b56f99f
SHA1d30a59d7ff849ad687b75ee34b9500b4339bc33f
SHA256e9393f2691562a3051f1ce5b214096110b8468e4111544a46cf7e7163a0770f8
SHA512f3df4c4a4964905f7c3f35bad36526a6da59715b917621cb24deb90033265333de07011ead098a58cb90a9edc4b9269aa4137f5bf40ce78501c99dcbebb1a069
-
/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/IjuGXW.jsonFilesize
1.9MB
MD5e6ae9c9e091a4573d4805b0e74b2269d
SHA119cc603c447634257534cdbe70468975992e9be9
SHA2563b4f9f978c6667d8f729ea17799cd477151afe0899bbd231be2895dbd14fec9a
SHA512a1ee2c1168119bf0684f097907403490707586bd7d76a5de16560e9863bec9dcd948045f55696ba95aae248fe5843ec4fbaf7f0c8b29aa9962e2f22c9bea228c
-
/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/IjuGXW.json.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/oat/IjuGXW.json.cur.profMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/oat/x86/IjuGXW.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/oat/x86/IjuGXW.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e