Analysis
-
max time kernel
3868500s -
max time network
135s -
platform
android_x64 -
resource
android-x64-arm64-20220310-en -
submitted
21-05-2022 11:28
General
-
Target
5e5e52f820cccad6d98561d004f6c7d892586e45b569f24b72596b9132940b98.apk
-
Size
3.1MB
-
MD5
a5fb657df3fe76ae6557bf4c38b05f36
-
SHA1
cb61617c688c2c1d214c9922537bffb16eb4f0bf
-
SHA256
5e5e52f820cccad6d98561d004f6c7d892586e45b569f24b72596b9132940b98
-
SHA512
3c60a1e2c009358a78da46b98e9e38c50c60da30459af8e7a6cc94ecf1c9ed662abe80ec17eb53bf1d416025b2a5fbcee10a5830dfe2b61f8bca5968db3b309d
Malware Config
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
Processes
-
fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/IjuGXW.jsonFilesize
1.9MB
MD54be06f9af32cbf9cf49c70a01536d4bb
SHA13e8fb2a09da938bed8fe42555d7f88cb9fb0eb63
SHA256ad27515d802299423aeed425b557c9a56c3a765e08e68a1f79d28e19fec5d0be
SHA5125474372c16959c677402d41db0046c8b83ba0c101ab0ea1e930e3fcb730e1d2e8c1de76d737e3289e8b392d5f8b306a2b168ad20714c63b86e0c2d243446621c
-
/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/IjuGXW.jsonFilesize
1.9MB
MD5e6ae9c9e091a4573d4805b0e74b2269d
SHA119cc603c447634257534cdbe70468975992e9be9
SHA2563b4f9f978c6667d8f729ea17799cd477151afe0899bbd231be2895dbd14fec9a
SHA512a1ee2c1168119bf0684f097907403490707586bd7d76a5de16560e9863bec9dcd948045f55696ba95aae248fe5843ec4fbaf7f0c8b29aa9962e2f22c9bea228c
-
/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/IjuGXW.jsonFilesize
1.9MB
MD5e6ae9c9e091a4573d4805b0e74b2269d
SHA119cc603c447634257534cdbe70468975992e9be9
SHA2563b4f9f978c6667d8f729ea17799cd477151afe0899bbd231be2895dbd14fec9a
SHA512a1ee2c1168119bf0684f097907403490707586bd7d76a5de16560e9863bec9dcd948045f55696ba95aae248fe5843ec4fbaf7f0c8b29aa9962e2f22c9bea228c
-
/data/user/0/fbhobdherp.fctfhkpirgsqbqmloslpfjb.hobazscyuyeca/app_DynamicOptDex/oat/IjuGXW.json.cur.profMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e