anubis | d7008a7c9191c544c9a48765e842c68e6d07cb3c6835d4dd6c13f910ab85889c

Analysis

max time kernel
3891352s
max time network
166s
platform
android_x64
resource
android-x64-20220310-en
submitted
21-05-2022 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7008a7c9191c544c9a48765e842c68e6d07cb3c6835d4dd6c13f910ab85889c.apk
Size

3.3MB
MD5

345e455d81a7030b61ba40633b19d7c7
SHA1

f405af1c0af5489651a390270d6fc6f54cc2f88f
SHA256

d7008a7c9191c544c9a48765e842c68e6d07cb3c6835d4dd6c13f910ab85889c
SHA512

e30b071ed532e9e095b7eedc767c0d8c76e6f337ccaa57621d40f13822bf9fb0efccd5d715f5355a5e47435f0b380bbb19fb8dd3afb7733bc7936fcec5353de9

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

rmuatldkwkiyiofjoqmm.egbqacfklh.kuti

ioc	pid	process
/data/user/0/rmuatldkwkiyiofjoqmm.egbqacfklh.kuti/app_DynamicOptDex/TxBZWS.json	6192	rmuatldkwkiyiofjoqmm.egbqacfklh.kuti
/data/user/0/rmuatldkwkiyiofjoqmm.egbqacfklh.kuti/app_DynamicOptDex/TxBZWS.json	6192	rmuatldkwkiyiofjoqmm.egbqacfklh.kuti

Reads information about phone network operator.
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
evasion

Processes:

rmuatldkwkiyiofjoqmm.egbqacfklh.kuti

description ioc process

Framework API call android.hardware.SensorManager.registerListener rmuatldkwkiyiofjoqmm.egbqacfklh.kuti

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	rmuatldkwkiyiofjoqmm.egbqacfklh.kuti

rmuatldkwkiyiofjoqmm.egbqacfklh.kuti
1⤵
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:6192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/rmuatldkwkiyiofjoqmm.egbqacfklh.kuti/app_DynamicOptDex/TxBZWS.json
Filesize
2.1MB

MD5
c2f9e2cdd740bfc66ccc0e106804b18a

SHA1
69a5f54793c5e094cb02b8d08184ab0d38480f9b

SHA256
853381527aa016e6074408ade344b3fa12cf0ec8eb7ddcdb33029434c17e05bc

SHA512
2dbea5a7d6fbf22bc91bedfa1475323c0726df770e80428e7f17b6136ec7c70c4e474a6e528580138fbfa7c3e8a6db941aefb1dc0a3470bad67a5d1eb880e5bf

Download Submit
/data/user/0/rmuatldkwkiyiofjoqmm.egbqacfklh.kuti/app_DynamicOptDex/TxBZWS.json
Filesize
2.1MB

MD5
8b57734cd6c6b158c6fabe0624c7b73e

SHA1
48a84b77baf6064eb4f8b0eedcee825fe78e1346

SHA256
d517d6aa025bfcd97a5df225a0a53acffc92f9b0f861ac0ed5a03f77a72cfabb

SHA512
bb15ff03a523ee0fb3dd809789481112cf2003bb59506d7aa831ba133c880a7eb81a306e7158b99da4a052ed1ec6c8185c7e240970d34e254c0a8320c4b02ace

Download Submit
/data/user/0/rmuatldkwkiyiofjoqmm.egbqacfklh.kuti/app_DynamicOptDex/TxBZWS.json
Filesize
2.1MB

MD5
8b57734cd6c6b158c6fabe0624c7b73e

SHA1
48a84b77baf6064eb4f8b0eedcee825fe78e1346

SHA256
d517d6aa025bfcd97a5df225a0a53acffc92f9b0f861ac0ed5a03f77a72cfabb

SHA512
bb15ff03a523ee0fb3dd809789481112cf2003bb59506d7aa831ba133c880a7eb81a306e7158b99da4a052ed1ec6c8185c7e240970d34e254c0a8320c4b02ace

Download Submit
/data/user/0/rmuatldkwkiyiofjoqmm.egbqacfklh.kuti/app_DynamicOptDex/oat/TxBZWS.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit