anubis | c2b018b45bbef87b25e9ba0c362127ce1c7a5f0431626774df03283a7c349e9f | Triage™

Analysis

max time kernel
598048s
max time network
165s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
02/06/2022, 08:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
C2B018B45BBEF87B25E9BA0C362127CE1C7A5F0431626774DF03283A7C349E9F.apk
Size 309KB
Sample220602-kwfdjaabhk
SHA256 c2b018b45bbef87b25e9ba0c362127ce1c7a5f0431626774df03283a7c349e9f
MD5 05380a38f3a071a898f7718b3eb3b349
SHA1 9737abc2e4f140797fec3d09162bf7e7b3832915
SHA512 0ea414bd9e865867b4407eacc21e09ebcc5c292d903ca45a3f5d21741b01aa4c51f10b7fb465c22453d20e08d1ac3ae02c8d96388ec2d987f702d3feb54d9396
MD5 SHA1 SHA512

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	wocwvy.czyxoxmbauu.slsa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	wocwvy.czyxoxmbauu.slsa

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	wocwvy.czyxoxmbauu.slsa

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	wocwvy.czyxoxmbauu.slsa

wocwvy.czyxoxmbauu.slsa
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:6820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads