Analysis
-
max time kernel
3868362s -
max time network
169s -
platform
android_x64 -
resource
android-x64-arm64-20220310-en -
submitted
21-05-2022 11:27
General
-
Target
754e209f937a73b269637e3977547c94a04fe64aedd8c0e1ddc7cb9e35ec73d0.apk
-
Size
3.0MB
-
MD5
c2f7222d9a2c902d6a3fc1d12683b9fa
-
SHA1
a6189c4a502bf8060443d88b6651b075bc3cad45
-
SHA256
754e209f937a73b269637e3977547c94a04fe64aedd8c0e1ddc7cb9e35ec73d0
-
SHA512
189e33cc59420795151a7855775e266fe9ff6113bf463b280bd4e85081d8188c3783141c7578c6b81d11f84f3366f071db3f55833273b4b4afb7e52a1a54de5e
Malware Config
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
Processes
-
hyxrx.tmokakxzfnrhdpn.ahnssfisrjygnhxixjabrqxm1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/hyxrx.tmokakxzfnrhdpn.ahnssfisrjygnhxixjabrqxm/app_DynamicOptDex/PoTL.jsonFilesize
1.8MB
MD56b5bd1625cd1936b6772447c577dd9df
SHA1b3521ea14d717bb47e1082415f7f90b270a869fb
SHA2561ff617b6e1f01722b8a9e0a48d03e216ab53876fba4cbcad7a30126b80c3babb
SHA51246a911603e280f28a1e381ca17bff8e01d635106349867893a64d6a2f106d00fb90646f8f4ac95ea4c6f16506430bda519d9bf307a62aa59ac51176ce5dd98b3
-
/data/user/0/hyxrx.tmokakxzfnrhdpn.ahnssfisrjygnhxixjabrqxm/app_DynamicOptDex/PoTL.jsonFilesize
1.8MB
MD51e344f2fa4df32b7ad9290a07b971439
SHA1b26c4904e89651d201a347878c44ae58746cb669
SHA256aa0813903b04ab984aa8747b91ac4bc5aac6a0449a7f54288e6cf5256d1b2f45
SHA512f20ff348897200f3f0e39099202ad5ec89d4b7891c084015e6832bc05c1feb4bb9ebf9589656ded975f73f852ffddcdf3c840ad0a544df7b836b045f7a3f2477
-
/data/user/0/hyxrx.tmokakxzfnrhdpn.ahnssfisrjygnhxixjabrqxm/app_DynamicOptDex/PoTL.jsonFilesize
1.8MB
MD51e344f2fa4df32b7ad9290a07b971439
SHA1b26c4904e89651d201a347878c44ae58746cb669
SHA256aa0813903b04ab984aa8747b91ac4bc5aac6a0449a7f54288e6cf5256d1b2f45
SHA512f20ff348897200f3f0e39099202ad5ec89d4b7891c084015e6832bc05c1feb4bb9ebf9589656ded975f73f852ffddcdf3c840ad0a544df7b836b045f7a3f2477
-
/data/user/0/hyxrx.tmokakxzfnrhdpn.ahnssfisrjygnhxixjabrqxm/app_DynamicOptDex/oat/PoTL.json.cur.profMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e