anubis | 814001a82cc709413ba6d301ad65bd32052e4aa493313117e50cfcb419e3d086

Analysis

max time kernel
597086s
max time network
170s
platform
android_x64
resource
android-x64-20220310-en
submitted
02/06/2022, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
814001A82CC709413BA6D301AD65BD32052E4AA493313117E50CFCB419E3D086.apk
Size 2.5MB
Sample220602-ke7rfsaahn
SHA256 814001a82cc709413ba6d301ad65bd32052e4aa493313117e50cfcb419e3d086
MD5 ebb3f0c1dd02fa60eaae2a881445f903
SHA1 32608b24115e7450dd94305efdfa982e0b6ea4bb
SHA512 f01d16e2d8a0611a31692e7a30062981cc8d62229b5d21515bf1fb4a74ec01cfd7c69f5014abbfc3fdbbe29135a3286bfaf62ca74fbc8048184285a1095a2a79
MD5 SHA1 SHA512

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Extracted

Family

anubis

https://martilerrentcarskirolrte.com/

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json	6162	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr
/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json	6162	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr

Reads information about phone network operator.

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr

pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr
1⤵
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:6162

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Fg.json

Path /data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json
Size 1.2MB
SHA256 ae1a46741a3008bb7468330fca80669fdf8b3c5e339eecf12d1114b58f1ab594
MD5 ffb7b0eab9e8ad8e78a3381e08ba8eb2
SHA1 0da7b6813dc505c317a2bbae88c3c52eb55e9849
SHA512 b5426d9731355102de5740ed66e7777dc10b32d30164091278c3c7220fd5efaf375f07882124edb0deab7d66d6edc11e0f5e5744656fb2bc98fe5474ddeea9fa
SSDEEP 24576:HAjB+Ua8xmVAXjC4tbWBSa28D7P+L0UHCCVjdmW+wOJsIj9kuAO7n:uBaqmVAXO4tiBSOn2IUzVj7+wePPAOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fg.json

Path /data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json
Size 1.2MB
SHA256 fbb237e0110dcfb1f0b54ddb378adc102d468396a781db091217a1d3c6c8c1c2
MD5 75da38c80c34fa099c49b84e4a38f757
SHA1 a05c421eaa6d3e9d7d372386e06f467502f2c27a
SHA512 e37b3e85c9d59796596063cbd4769054d6eecced7fef8d2d2e1ea6938ab1d1b88f5a4e1c4f165374a5ffe1698938e9a88c970941131874dc3b446ea181a6c6e5
SSDEEP 12288:jSqnjAp1MC3oVQmDFbFcrGXs5wghgrnTercBliy+TRBYVPI18yMkTi:m8AvMCYVQOFSKXs5wghgrnTfLkuNIKx
MD5 SHA1 SHA512 SSDEEP

Download

Fg.json

Path /data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json
Size 1.2MB
SHA256 fbb237e0110dcfb1f0b54ddb378adc102d468396a781db091217a1d3c6c8c1c2
MD5 75da38c80c34fa099c49b84e4a38f757
SHA1 a05c421eaa6d3e9d7d372386e06f467502f2c27a
SHA512 e37b3e85c9d59796596063cbd4769054d6eecced7fef8d2d2e1ea6938ab1d1b88f5a4e1c4f165374a5ffe1698938e9a88c970941131874dc3b446ea181a6c6e5
SSDEEP 12288:jSqnjAp1MC3oVQmDFbFcrGXs5wghgrnTercBliy+TRBYVPI18yMkTi:m8AvMCYVQOFSKXs5wghgrnTfLkuNIKx
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads