Behavioral Report

max time kernel3891464s
max time network128s
platformandroid_x86
resourceandroid-x86-arm-20220310-en
submitted21-05-2022 18:43

Report
Files
Registry
Network
Processes
Mutex
Misc

Target

7dfa0dbea9a306d9dc333383d0368275f4ea2d38a1dc93806de318621748ad29.apk

Filesize

3MB

Completed

21-05-2022 18:48

Task

behavioral1

Score

10^/10

MD5

0eeccbf85800198cc7525fab905819e3

SHA1

8286fb6060891787a81d89e4a1e85e707219e95d

SHA256

7dfa0dbea9a306d9dc333383d0368275f4ea2d38a1dc93806de318621748ad29

SHA512

b1bf344a6ed36d913f2e47d1872752384e229a80c33b06c09dc74823aa52ed469b3d7499b2948641a9baaf305676a1b687afc479a704a951146011d04e17bfc0

anubis banker evasion infostealer trojan

Anubis banker

Description

Android banker that uses overlays.

Tags

banker trojan infostealer anubis

Makes use of the framework's Accessibility service.

iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi

Reported IOCs

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi

Acquires the wake lock.
iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi

Reported IOCs

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi

Loads dropped Dex/Jar

iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/rmmixOW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/oat/x86/rmmixOW.odex --compiler-filter=quicken --class-loader-context=&

Description

Runs executable file dropped to the device during analysis.

Reported IOCs

ioc	pid	process
/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/rmmixOW.json	5125	iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi
/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/rmmixOW.json	5190	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/rmmixOW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/oat/x86/rmmixOW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/rmmixOW.json	5125	iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi

Reads information about phone network operator.
Listens for changes in the sensor environment (might be used to detect emulation).
iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi

Tags

evasion

Reported IOCs

description ioc process

Framework API call android.hardware.SensorManager.registerListener iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi

iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi

Makes use of the framework's Accessibility service.
Acquires the wake lock.
Loads dropped Dex/Jar
Listens for changes in the sensor environment (might be used to detect emulation).

PID:5125

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/rmmixOW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/oat/x86/rmmixOW.odex --compiler-filter=quicken --class-loader-context=&

Loads dropped Dex/Jar

PID:5190

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

00:00 00:00

/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/oat/rmmixOW.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/oat/x86/rmmixOW.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/oat/x86/rmmixOW.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/rmmixOW.json
MD5
818dcb1971cec39fe0aff7e676f5125f

SHA1
f5e0fa4b7ee5f62b9d75d5a37ac35bd3ba9e2efc

SHA256
b5c9fec9dfe84316d726f683efb52377185d2c7b6ff22ca3e0954b7211cb5e12

SHA512
0cf99b61616bc5434239621eb2a765bba4f91f7c4bb8dd74406aaa7962c6fa250acf4ca536adf139b0153a456ff7da1d5beeac151a453a5bdc0a7f819b12b340

Download Submit
/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/rmmixOW.json
MD5
574b3fac4dcfa007d09f1703a2acc46a

SHA1
86d87a1ab5542492f6ee07366f7af5d7751bf96f

SHA256
9983e0dc841b632be82906b66342f575903d56845ab3034e255bf279665429de

SHA512
6e23277a73b070e987c3d9f9b06f2268e3e625f4f1187265d8dde4ac7939927baea530cff3123f38139fda1690b542e79e2cabe0cc4f25134a84c46bab2e2ab1

Download Submit
/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/rmmixOW.json
MD5
672276f9c679cca39ed04896a621561c

SHA1
df65475dbb7e82b9ff300fe3eaa5bb41783b9d12

SHA256
3d4d9afbb9c4f342f31a6d5b84be0a285a4771e586086327bdd49e147b5f5a79

SHA512
e4862b6bd3707809b69286394fc2b2222309be7c5c98bc487618a14cb7a58bc53a6978fd9b608cad07fd6310f14e78d5e0496136feca9a6c08f89cb52963f64e

Download Submit
/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/rmmixOW.json
MD5
574b3fac4dcfa007d09f1703a2acc46a

SHA1
86d87a1ab5542492f6ee07366f7af5d7751bf96f

SHA256
9983e0dc841b632be82906b66342f575903d56845ab3034e255bf279665429de

SHA512
6e23277a73b070e987c3d9f9b06f2268e3e625f4f1187265d8dde4ac7939927baea530cff3123f38139fda1690b542e79e2cabe0cc4f25134a84c46bab2e2ab1

Download Submit
/data/user/0/iqokqlckjnofroytbiiyoyxthg.cnezuqrfioksy.tgmi/app_DynamicOptDex/rmmixOW.json.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Filter: none

Description

Tags

Reported IOCs

Reported IOCs

Description

Reported IOCs

Tags

Reported IOCs

Title