Analysis

  • max time kernel
    3866532s
  • max time network
    172s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    21/05/2022, 11:28

General

  • Target
    32b556f98d0d2bc0f14aab12585edb263296dabca5d5a1f5752031b0412338df.apk
  • Size 3.2MB
  • Sample220521-nld99shaam
  • SHA256 32b556f98d0d2bc0f14aab12585edb263296dabca5d5a1f5752031b0412338df
  • MD5 SHA1 SHA512

Malware Config

Signatures

  • Anubis banker

    Android banker that uses overlays.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

Processes

  • eqzthjrbymohme.tximzugaw.rpsljgcyppsbasaszepboedp
    1⤵
    • Loads dropped Dex/Jar
    • Listens for changes in the sensor environment (might be used to detect emulation).
    PID:6327

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        qebl.json

        • Path /data/user/0/eqzthjrbymohme.tximzugaw.rpsljgcyppsbasaszepboedp/app_DynamicOptDex/qebl.json
        • Size 2.0MB
        • SHA256 77186d6154557a401137ed484af794c1c99a1ada866683fa3d791665b3bb603e
        • MD5 SHA1 SHA512 SSDEEP

        qebl.json

        • Path /data/user/0/eqzthjrbymohme.tximzugaw.rpsljgcyppsbasaszepboedp/app_DynamicOptDex/qebl.json
        • Size 2.0MB
        • SHA256 8f4cf4c901a2eadad34e51f2b38f3fcede91c0eb5c332b16f4db0723eb1ffda7
        • MD5 SHA1 SHA512 SSDEEP

        qebl.json

        • Path /data/user/0/eqzthjrbymohme.tximzugaw.rpsljgcyppsbasaszepboedp/app_DynamicOptDex/qebl.json
        • Size 2.0MB
        • SHA256 8f4cf4c901a2eadad34e51f2b38f3fcede91c0eb5c332b16f4db0723eb1ffda7
        • MD5 SHA1 SHA512 SSDEEP