Analysis
-
max time kernel
3891374s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
21-05-2022 18:43
Static task
static1
Behavioral task
behavioral1
Sample
b7cbb06f8dadeb1530eb99a7a38834433ef0d9f5e9d049d79c70d41ea6690642.apk
Resource
android-x86-arm-20220310-en
Behavioral task
behavioral2
Sample
b7cbb06f8dadeb1530eb99a7a38834433ef0d9f5e9d049d79c70d41ea6690642.apk
Resource
android-x64-20220310-en
Behavioral task
behavioral3
Sample
b7cbb06f8dadeb1530eb99a7a38834433ef0d9f5e9d049d79c70d41ea6690642.apk
Resource
android-x64-arm64-20220310-en
General
-
Target
b7cbb06f8dadeb1530eb99a7a38834433ef0d9f5e9d049d79c70d41ea6690642.apk
-
Size
3.3MB
-
MD5
9c4de47597b35a666200242b4ad7445e
-
SHA1
bfed23c651753ec341f9d398a974f03944c28c1a
-
SHA256
b7cbb06f8dadeb1530eb99a7a38834433ef0d9f5e9d049d79c70d41ea6690642
-
SHA512
eb93729e7d65f5d4746974a0c4e6de5dfc04286f855f903bb635930118ba25c562375b6a2482944d61855454303d14772edc7330e5b17a7fb3f87f3787aa2ac7
Malware Config
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Makes use of the framework's Accessibility service. 3 IoCs
Processes:
xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupedescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe -
Acquires the wake lock. 1 IoCs
Processes:
xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupedescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/styYx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/oat/x86/styYx.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/styYx.json 5120 xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe /data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/styYx.json 5150 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/styYx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/oat/x86/styYx.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/styYx.json 5120 xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe -
Reads information about phone network operator.
-
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
Processes:
xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupedescription ioc process Framework API call android.hardware.SensorManager.registerListener xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe
Processes
-
xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/styYx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/oat/x86/styYx.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/oat/styYx.json.cur.profMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/oat/x86/styYx.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/oat/x86/styYx.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/styYx.jsonFilesize
2.1MB
MD565205a847790cd01347516dfdf7be420
SHA1291875216bf8c4871b348c2f44ff6c5a6cb11ea8
SHA256af174c9a0b6bfe2c2fe07b3b6282a7860a182b1f60993e43f4a26e94081bd8cf
SHA512a7dd529533eb5c3cb9ceab62fca1bb38603328762ddafae09726f6d735ae2d2de73c1616259582250c767dc6e67aae584448bbe98e5ee37bd5a289b7423dc86a
-
/data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/styYx.jsonFilesize
2.1MB
MD584eaa01813878da758b6ce6fb5bcb02e
SHA1d1c58ac9d5932bc2254ade63184358ad1948d784
SHA256c01c73e78c03f01f15d202616bf146b76c6a7089cb02c52b2960063ddeee814c
SHA5126ec77a4870616e45ead083a25822bcf2c6b777de61f0402ee5b201aee37f20168d9ca47efb73465444ebee61423cc8b32db4115fcbb7207c58c6140f167d49e2
-
/data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/styYx.jsonFilesize
2.1MB
MD55850d60e3730de69a94ddd64bd63ca18
SHA1aa83257edc4b4facdccee99ccf25c1e2ca6b2410
SHA2561f18fa12f8c9825dec453524408fe003116b8420011907c6d01c3fa7dfa66d5d
SHA5122310365260b84abe65a4682f3b3904e48b455e251d3601760b842a96029c1fff1624282965455a918f0a71e336cf2b1e3bd5c082bbc7b8ab49803c6feb2e4f03
-
/data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/styYx.jsonFilesize
2.1MB
MD584eaa01813878da758b6ce6fb5bcb02e
SHA1d1c58ac9d5932bc2254ade63184358ad1948d784
SHA256c01c73e78c03f01f15d202616bf146b76c6a7089cb02c52b2960063ddeee814c
SHA5126ec77a4870616e45ead083a25822bcf2c6b777de61f0402ee5b201aee37f20168d9ca47efb73465444ebee61423cc8b32db4115fcbb7207c58c6140f167d49e2
-
/data/user/0/xftzlwsyqmjbebtut.kzbrhkdkifld.lhoftclcdminupe/app_DynamicOptDex/styYx.json.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e