anubis | 301DA19ACF0824798B183C8A0FB7E4A01C3AE7E1F3B70F0D81A68A4C8E3079E4[.]apk

General

Target
301DA19ACF0824798B183C8A0FB7E4A01C3AE7E1F3B70F0D81A68A4C8E3079E4.apk
Size 273KB
Sample220602-kdp51saafr
SHA256 301da19acf0824798b183c8a0fb7e4a01c3ae7e1f3b70f0d81a68a4c8e3079e4
MD5 5cb79cdf431254308e94e14c9049c631
SHA1 a878b8590ce937f824a7994fc2a1557e11a35888
SHA512 2b5e0602b9af02f277a2496636960a7e03762f4ae29c9d5166ad970b54e81013da4171ebcab5e6763bd1a9f2a6f7cc39ce7d8eea2de0f37b7679de548a4893e1
SSDEEP 6144:f00Q8n79pWjr69pkYTwcMQzG3FuCGavVgAxO7FJVD2CLg+ijg:fBnJKr6PkdES3/GOVgCQFiCEvjg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

anubis

Malware Config

Extracted

Family

anubis

C2

https://taleplerburda.tk/

Signatures

Anubis family
anubis

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

File Explorer

301DA19ACF0824798B183C8A0FB7E4A01C3AE7E1F3B70F0D81A68A4C8E3079E4.apk

.apk 273KB

301DA19ACF0824798B183C8A0FB7E4A01C3AE7E1F3B70F0D81A68A4C8E3079E4.apk

SHA256 301da19acf0824798b183c8a0fb7e4a01c3ae7e1f3b70f0d81a68a4c8e3079e4
MD5 5cb79cdf431254308e94e14c9049c631
SHA1 a878b8590ce937f824a7994fc2a1557e11a35888
SHA512 2b5e0602b9af02f277a2496636960a7e03762f4ae29c9d5166ad970b54e81013da4171ebcab5e6763bd1a9f2a6f7cc39ce7d8eea2de0f37b7679de548a4893e1
SSDEEP 6144:f00Q8n79pWjr69pkYTwcMQzG3FuCGavVgAxO7FJVD2CLg+ijg:fBnJKr6PkdES3/GOVgCQFiCEvjg
MD5 SHA1 SHA512 SSDEEP

android

wocwvy.czyxoxmbauu.slsa

Android Permissions

301DA19ACF0824798B183C8A0FB7E4A01C3AE7E1F3B70F0D81A68A4C8E3079E4.apk

Permissions

android.permission.ACCESS_FINE_LOCATION

android.permission.GET_TASKS

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.PACKAGE_USAGE_STATS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.ACCESS_NETWORK_STATE

android.permission.CALL_PHONE

android.permission.INTERNET

android.permission.SEND_SMS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.RECORD_AUDIO

android.permission.READ_CONTACTS

android.permission.READ_PHONE_STATE

android.permission.WAKE_LOCK

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

301DA19ACF0824798B183C8A0FB7E4A01C3AE7E1F3B70F0D81A68A4C8E3079E4.apk

com.google.android.gms.common.api.GoogleApiActivity

wocwvy.czyxoxmbauu.slsa.ncec.myvbo

wocwvy.czyxoxmbauu.slsa.opzsdswiddt

wocwvy.czyxoxmbauu.slsa.ncec.sxfl

wocwvy.czyxoxmbauu.slsa.oyqwzkyy.qvhy.cwwzcpcu

wocwvy.czyxoxmbauu.slsa.ncec.pltrfi

wocwvy.czyxoxmbauu.slsa.ncec.wami

wocwvy.czyxoxmbauu.slsa.ncec.fyqapyahei

wocwvy.czyxoxmbauu.slsa.ncec.bdxyqqt

wocwvy.czyxoxmbauu.slsa.ncec.dzudmx

wocwvy.czyxoxmbauu.slsa.ncec.gcmysyhtova

wocwvy.czyxoxmbauu.slsa.ncec.ozkgyjpxtyxajmm

wocwvy.czyxoxmbauu.slsa.ncec.khypzruy

wocwvy.czyxoxmbauu.slsa.ncec.kcdbt

wocwvy.czyxoxmbauu.slsa.ncec.fymeshs

wocwvy.czyxoxmbauu.slsa.ncec.ovyvpsbxxrtayd

wocwvy.czyxoxmbauu.slsa.ncec.zjwruw

wocwvy.czyxoxmbauu.slsa.lmimy

wocwvy.czyxoxmbauu.slsa.wfveenegvz

wocwvy.czyxoxmbauu.slsa.frvvkgp

wocwvy.czyxoxmbauu.slsa.ukhakhcgifofl

wocwvy.czyxoxmbauu.slsa.jtfxlnc

wocwvy.czyxoxmbauu.slsa.blkzyyyfc

wocwvy.czyxoxmbauu.slsa.whemsbk

wocwvy.czyxoxmbauu.slsa.nepgaqmyfrhw

wocwvy.czyxoxmbauu.slsa.clgqtzqdh

wocwvy.czyxoxmbauu.slsa.usbvhkriufnc

wocwvy.czyxoxmbauu.slsa.egxltnv

wocwvy.czyxoxmbauu.slsa.kldqwysgkfcrmq

wocwvy.czyxoxmbauu.slsa.oyqwzkyy.qvhy.jkeggfql

wocwvy.czyxoxmbauu.slsa.oyqwzkyy.qvhy.nvsdtnxkzjgw

wocwvy.czyxoxmbauu.slsa.oyqwzkyy.hzgktdtr.brtltydqhiuqbb

wocwvy.czyxoxmbauu.slsa.xelytgswelv

wocwvy.czyxoxmbauu.slsa.mvqkjokaxfrpf

wocwvy.czyxoxmbauu.slsa.wahiuolww

wocwvy.czyxoxmbauu.slsa.oyqwzkyy.hzgktdtr.cpysnikhf

wocwvy.czyxoxmbauu.slsa.oyqwzkyy.dxivifswvkcvwz.wifu

wocwvy.czyxoxmbauu.slsa.oyqwzkyy.dxivifswvkcvwz.dshd

wocwvy.czyxoxmbauu.slsa.kuv.sfswwunyakpjr

wocwvy.czyxoxmbauu.slsa.ttiegryczsx

wocwvy.czyxoxmbauu.slsa.blyvffs

wocwvy.czyxoxmbauu.slsa.pworotsvjdlioho.cmtstflxlxb

wocwvy.czyxoxmbauu.slsa.pworotsvjdlioho.qpgopfninoaazln

wocwvy.czyxoxmbauu.slsa.pworotsvjdlioho.hypihteeavv

wocwvy.czyxoxmbauu.slsa.pworotsvjdlioho.hwfe

Android Permissions

301DA19ACF0824798B183C8A0FB7E4A01C3AE7E1F3B70F0D81A68A4C8E3079E4.apk