anubis | 15b4782c63597ddda6b6b14a67e04078d922e1119e5b5a9d8e766d7328ac4fe9

Analysis

max time kernel
3866592s
max time network
166s
platform
android_x64
resource
android-x64-20220310-en
submitted
21-05-2022 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15b4782c63597ddda6b6b14a67e04078d922e1119e5b5a9d8e766d7328ac4fe9.apk
Size

3.1MB
MD5

d4ffb660368d7bb7be0093a71e849f9b
SHA1

871038a073aa7dc92f0d7945942136ac590e6914
SHA256

15b4782c63597ddda6b6b14a67e04078d922e1119e5b5a9d8e766d7328ac4fe9
SHA512

bf7147600f058c73dcb1485ac17b9749d61b9da8017ef369bdb0d040ffb8c96980a5360c83dd56f14223b0456fbb7559eb2d65894340eeb50985021b87a2d217

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

gsliirutrinmcgsqt.psdco.zypkxtiflbpbclptmrtb

ioc	pid	process
/data/user/0/gsliirutrinmcgsqt.psdco.zypkxtiflbpbclptmrtb/app_DynamicOptDex/FgxTQY.json	6342	gsliirutrinmcgsqt.psdco.zypkxtiflbpbclptmrtb
/data/user/0/gsliirutrinmcgsqt.psdco.zypkxtiflbpbclptmrtb/app_DynamicOptDex/FgxTQY.json	6342	gsliirutrinmcgsqt.psdco.zypkxtiflbpbclptmrtb

Reads information about phone network operator.
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
evasion

Processes:

gsliirutrinmcgsqt.psdco.zypkxtiflbpbclptmrtb

description ioc process

Framework API call android.hardware.SensorManager.registerListener gsliirutrinmcgsqt.psdco.zypkxtiflbpbclptmrtb

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	gsliirutrinmcgsqt.psdco.zypkxtiflbpbclptmrtb

gsliirutrinmcgsqt.psdco.zypkxtiflbpbclptmrtb
1⤵
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:6342

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/gsliirutrinmcgsqt.psdco.zypkxtiflbpbclptmrtb/app_DynamicOptDex/FgxTQY.json
Filesize
2.0MB

MD5
15fe61cb384348da1acd5133796e3e9d

SHA1
9028e3750cea578576dd1b2bb2dbaffc28e4357d

SHA256
83d6815484727e92667290aa29ce08b77e0a660f5a3ed5a4cadd66c93624ed1d

SHA512
fa8c825c752d18c78502a0a3d9e4572c017e94f6539e7e93c3df8c88e0d88262a3adaeaa24e04711c061591ab4ca64cb37968db8b04a0554db0f81dd77a2e8cd

Download Submit
/data/user/0/gsliirutrinmcgsqt.psdco.zypkxtiflbpbclptmrtb/app_DynamicOptDex/FgxTQY.json
Filesize
2.0MB

MD5
a6389db1c9f058212cba2e429825cadf

SHA1
51c97a5b5d60af7e052efdb8086ec8499e164259

SHA256
521b1bd00f3d201ac2704f8c6f4cc509dd8b5c813c5df4b9b089d13b34e61299

SHA512
a45ac22765763d2406b86c869276eaad53d0fa42b0b90ab9df3f79dfd9af586b5e727c4f17aa9d200f8109e1fd01902e17b9d1f61164fa82c9928ffba4704437

Download Submit
/data/user/0/gsliirutrinmcgsqt.psdco.zypkxtiflbpbclptmrtb/app_DynamicOptDex/FgxTQY.json
Filesize
2.0MB

MD5
a6389db1c9f058212cba2e429825cadf

SHA1
51c97a5b5d60af7e052efdb8086ec8499e164259

SHA256
521b1bd00f3d201ac2704f8c6f4cc509dd8b5c813c5df4b9b089d13b34e61299

SHA512
a45ac22765763d2406b86c869276eaad53d0fa42b0b90ab9df3f79dfd9af586b5e727c4f17aa9d200f8109e1fd01902e17b9d1f61164fa82c9928ffba4704437

Download Submit
/data/user/0/gsliirutrinmcgsqt.psdco.zypkxtiflbpbclptmrtb/app_DynamicOptDex/oat/FgxTQY.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit