Analysis
-
max time kernel
3866614s -
max time network
173s -
platform
android_x64 -
resource
android-x64-20220310-en -
submitted
21-05-2022 11:29
Static task
static1
Behavioral task
behavioral1
Sample
05ab401f23f1f4720d3e857a0f63f644e84876e43db097fe0ca4fd2f4b9088aa.apk
Resource
android-x86-arm-20220310-en
Behavioral task
behavioral2
Sample
05ab401f23f1f4720d3e857a0f63f644e84876e43db097fe0ca4fd2f4b9088aa.apk
Resource
android-x64-20220310-en
Behavioral task
behavioral3
Sample
05ab401f23f1f4720d3e857a0f63f644e84876e43db097fe0ca4fd2f4b9088aa.apk
Resource
android-x64-arm64-20220310-en
General
-
Target
05ab401f23f1f4720d3e857a0f63f644e84876e43db097fe0ca4fd2f4b9088aa.apk
-
Size
3.2MB
-
MD5
26755cfdbba7b5140cb10ffe71e1c6f0
-
SHA1
d2f6c8a94a480105f21d60276139f8d16f83abda
-
SHA256
05ab401f23f1f4720d3e857a0f63f644e84876e43db097fe0ca4fd2f4b9088aa
-
SHA512
96facb527e9a7e4f3ef035769e120a8df9ddb112078ff6bce61498d300bccb610a8b0ba4dc4a76282f19eb77b780e4f5e82782f6e3d47eaea168ea1b82c9e6d6
Malware Config
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
hjrbownpcx.mmscddasij.hqfysnajqrodywpjixftioc pid process /data/user/0/hjrbownpcx.mmscddasij.hqfysnajqrodywpjixft/app_DynamicOptDex/TnbjUy.json 6169 hjrbownpcx.mmscddasij.hqfysnajqrodywpjixft /data/user/0/hjrbownpcx.mmscddasij.hqfysnajqrodywpjixft/app_DynamicOptDex/TnbjUy.json 6169 hjrbownpcx.mmscddasij.hqfysnajqrodywpjixft -
Reads information about phone network operator.
-
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
Processes:
hjrbownpcx.mmscddasij.hqfysnajqrodywpjixftdescription ioc process Framework API call android.hardware.SensorManager.registerListener hjrbownpcx.mmscddasij.hqfysnajqrodywpjixft
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/hjrbownpcx.mmscddasij.hqfysnajqrodywpjixft/app_DynamicOptDex/TnbjUy.jsonFilesize
2.1MB
MD5491691a47307f1b29979f4be1911867e
SHA19c9ffe4fcf36d2d93762a029b9d9e6c9db049eb7
SHA2560da24cc669c06d13a3d5807012ba09c0b8b520592a64842bbf92f01293ee0f31
SHA51281b052c7a82f45188d6b6dd0e95f93ac38dd7f6e577517b60c305c1a131528f35f575da3b5c4d2325099ea2562dab7e5aa5ec2887876aed036facb3f8099fe8a
-
/data/user/0/hjrbownpcx.mmscddasij.hqfysnajqrodywpjixft/app_DynamicOptDex/TnbjUy.jsonFilesize
2.1MB
MD541143ad76bcff90d71d318601362dfc2
SHA1a61569b5b129a40948cbb34b0693904577193fbe
SHA2569051fc7a6de42d9c0baacf997997c7e3deb1bf469e5d4efd1c81d2f619a14ebd
SHA512dd52986c3147418ee80675b3633c08d93f659e060ac4a881bb9a00fb1a230c11bffca7ffe6721220a83c4299197fbb498608fedba241c880a9e6d97f710cbafc
-
/data/user/0/hjrbownpcx.mmscddasij.hqfysnajqrodywpjixft/app_DynamicOptDex/TnbjUy.jsonFilesize
2.1MB
MD541143ad76bcff90d71d318601362dfc2
SHA1a61569b5b129a40948cbb34b0693904577193fbe
SHA2569051fc7a6de42d9c0baacf997997c7e3deb1bf469e5d4efd1c81d2f619a14ebd
SHA512dd52986c3147418ee80675b3633c08d93f659e060ac4a881bb9a00fb1a230c11bffca7ffe6721220a83c4299197fbb498608fedba241c880a9e6d97f710cbafc
-
/data/user/0/hjrbownpcx.mmscddasij.hqfysnajqrodywpjixft/app_DynamicOptDex/oat/TnbjUy.json.cur.profMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e