anubis | 0803711244bf3ab0b36a0993d640691be059a8bf407070834bfb427396cbb600

Analysis

max time kernel
596546s
max time network
171s
platform
android_x64
resource
android-x64-20220310-en
submitted
02/06/2022, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0803711244BF3AB0B36A0993D640691BE059A8BF407070834BFB427396CBB600.apk
Size 2.6MB
Sample220602-kdcjxsaafn
SHA256 0803711244bf3ab0b36a0993d640691be059a8bf407070834bfb427396cbb600
MD5 201aa553f5c98b69c975ab2e58704dce
SHA1 47a77bede86f2227491876a6dc8719fecd2c12fe
SHA512 cb08c024559862879182bbafcdb97c3a6e54ffa1d65b7948041f81b1b8327502035bbceb79806082c67ed970dc63cbfb37ba065c39e659041aaf6e5d37d5a93c
MD5 SHA1 SHA512

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Extracted

Family

anubis

http://lastknight.xyz/

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/jzjoeyec.jickdalgdphbbgfwwsqq.mdleckaegyywxzxol/app_DynamicOptDex/Hw.json	6250	jzjoeyec.jickdalgdphbbgfwwsqq.mdleckaegyywxzxol
/data/user/0/jzjoeyec.jickdalgdphbbgfwwsqq.mdleckaegyywxzxol/app_DynamicOptDex/Hw.json	6250	jzjoeyec.jickdalgdphbbgfwwsqq.mdleckaegyywxzxol

Reads information about phone network operator.

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	jzjoeyec.jickdalgdphbbgfwwsqq.mdleckaegyywxzxol

jzjoeyec.jickdalgdphbbgfwwsqq.mdleckaegyywxzxol
1⤵
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:6250

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Hw.json

Path /data/user/0/jzjoeyec.jickdalgdphbbgfwwsqq.mdleckaegyywxzxol/app_DynamicOptDex/Hw.json
Size 1.0MB
SHA256 c7b9d30a2b30e0094d31d4cf8e7dd792c0a05596f63289315172ecfc7ef56655
MD5 51588d04a2ed20d8f905f8f79a93424f
SHA1 03e198e88016962f0c36dd02c7d51163a2ca32f7
SHA512 55c766323560d9f621feefea4552551870bb08e097c189df162040067111966d380d4115a9aa38459e806d61ac9effd4a4d983701e1d7e93afcc24541655be5b
SSDEEP 24576:Kf0NEgrLqNIggkg4uLpaj1icHVOIcExEzYg+jja4dTabFoPOqI:RNEAuvgkqw1L4T+/XamPOqI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hw.json

Path /data/user/0/jzjoeyec.jickdalgdphbbgfwwsqq.mdleckaegyywxzxol/app_DynamicOptDex/Hw.json
Size 1.0MB
SHA256 cd19116835c30e72c2962d5927cfe90a3b969fec6adb73745e9e915f2dbe4c1f
MD5 9215e1c73441a676e58fd2145fc6cae8
SHA1 e805289cd48ddc256788d95eccc341a93d0be367
SHA512 a5283dcd131fcc37eed54f42536ba9cbf209eee03a21d586e9d86ffd8f5d9885cb52ba6de69011a4d8791ac045f10e25b7999ca42626ad23ef3844922a50ef15
SSDEEP 12288:NJfn3hX4zPwFJabHry3s5wnb63/NCEa/VjWfxbyojq1F:NJfnRXFwDu3s5wb63/caxbyom3
MD5 SHA1 SHA512 SSDEEP

Download

Hw.json

Path /data/user/0/jzjoeyec.jickdalgdphbbgfwwsqq.mdleckaegyywxzxol/app_DynamicOptDex/Hw.json
Size 1.0MB
SHA256 cd19116835c30e72c2962d5927cfe90a3b969fec6adb73745e9e915f2dbe4c1f
MD5 9215e1c73441a676e58fd2145fc6cae8
SHA1 e805289cd48ddc256788d95eccc341a93d0be367
SHA512 a5283dcd131fcc37eed54f42536ba9cbf209eee03a21d586e9d86ffd8f5d9885cb52ba6de69011a4d8791ac045f10e25b7999ca42626ad23ef3844922a50ef15
SSDEEP 12288:NJfn3hX4zPwFJabHry3s5wnb63/NCEa/VjWfxbyojq1F:NJfnRXFwDu3s5wb63/caxbyom3
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads