Analysis
- max time kernel
3866532s - max time network
172s - platform
android_x64 - resource
android-x64-20220310-en - submitted
21/05/2022, 11:28
Static task
static1
Behavioral task
behavioral1
Sample
32b556f98d0d2bc0f14aab12585edb263296dabca5d5a1f5752031b0412338df.apk
Resource
android-x86-arm-20220310-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
32b556f98d0d2bc0f14aab12585edb263296dabca5d5a1f5752031b0412338df.apk
Resource
android-x64-20220310-en
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
32b556f98d0d2bc0f14aab12585edb263296dabca5d5a1f5752031b0412338df.apk
Resource
android-x64-arm64-20220310-en
0 signatures
0 seconds
General
- Target 32b556f98d0d2bc0f14aab12585edb263296dabca5d5a1f5752031b0412338df.apk
- Size 3.2MB
- Sample220521-nld99shaam
- SHA256 32b556f98d0d2bc0f14aab12585edb263296dabca5d5a1f5752031b0412338df
- MD5 a5b27f03e3a6caac2a2b9b95644a12c3
- SHA1 2a71db680bbc3201d9b6fe010d46a51e4486e80a
- SHA512 d87bd13489fb4961c8ba41a053665f5abfd5434d149a5b60bbcf101f4469b14e13d7351ebc36fe0545d549a633e223124c47c3f878b02c97c29900bbb6e984e3
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Anubis banker
Android banker that uses overlays.
- Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/eqzthjrbymohme.tximzugaw.rpsljgcyppsbasaszepboedp/app_DynamicOptDex/qebl.json 6327 eqzthjrbymohme.tximzugaw.rpsljgcyppsbasaszepboedp /data/user/0/eqzthjrbymohme.tximzugaw.rpsljgcyppsbasaszepboedp/app_DynamicOptDex/qebl.json 6327 eqzthjrbymohme.tximzugaw.rpsljgcyppsbasaszepboedp - Reads information about phone network operator.
- Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener eqzthjrbymohme.tximzugaw.rpsljgcyppsbasaszepboedp
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/eqzthjrbymohme.tximzugaw.rpsljgcyppsbasaszepboedp/app_DynamicOptDex/qebl.json
- Size 2.0MB
- SHA256 77186d6154557a401137ed484af794c1c99a1ada866683fa3d791665b3bb603e
- MD5 db73400867594b37ec042d3bb67fecb0
- SHA1 66a7d94d9bcb1403e1de0452096ac767832499ca
- SHA512 871d4a0990b3bff89aecc5359391652d91fb5412466c29dd09119a33f5a2d374c4ac9b0aa10c429910e1d3db42ac0202813a84efe8626c87ea04d5455e2ef5a9
- SSDEEP 49152:qsbTaQ1PaGEmrhA21uulJdlIsOTXQlj0vQrK/P4l:XbXj7+2RI7Tg+vjO
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/eqzthjrbymohme.tximzugaw.rpsljgcyppsbasaszepboedp/app_DynamicOptDex/qebl.json
- Size 2.0MB
- SHA256 8f4cf4c901a2eadad34e51f2b38f3fcede91c0eb5c332b16f4db0723eb1ffda7
- MD5 be5930b922f627a43e823d502b4d9008
- SHA1 01efc514fad41cfcb8bfa3b53a08b8d30620f868
- SHA512 652c1c140d0a3fa53078340feec7d47bbcb4573dd9b77a3fc1bc284e84eb76ebe57d9cb629d8f9d21418c83d91a714b3b503c5197028488b9c41baca97b8d3fa
- SSDEEP 24576:MxrQvxWufXAXQXUX4JTyvv7XcEfmCYSaEKvKa3pke4Jkp:MqZK62M8fmCZa/S3/kp
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/eqzthjrbymohme.tximzugaw.rpsljgcyppsbasaszepboedp/app_DynamicOptDex/qebl.json
- Size 2.0MB
- SHA256 8f4cf4c901a2eadad34e51f2b38f3fcede91c0eb5c332b16f4db0723eb1ffda7
- MD5 be5930b922f627a43e823d502b4d9008
- SHA1 01efc514fad41cfcb8bfa3b53a08b8d30620f868
- SHA512 652c1c140d0a3fa53078340feec7d47bbcb4573dd9b77a3fc1bc284e84eb76ebe57d9cb629d8f9d21418c83d91a714b3b503c5197028488b9c41baca97b8d3fa
- SSDEEP 24576:MxrQvxWufXAXQXUX4JTyvv7XcEfmCYSaEKvKa3pke4Jkp:MqZK62M8fmCZa/S3/kp
- MD5 SHA1 SHA512 SSDEEP