Overview

overview

10

Static

static

7

814001A82C...86.apk

android_x86

10

814001A82C...86.apk

android_x64

10

814001A82C...86.apk

android_x64

10

Analysis

  • max time kernel
    607153s
  • max time network
    169s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220310-en
  • submitted
    02-06-2022 11:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    814001A82CC709413BA6D301AD65BD32052E4AA493313117E50CFCB419E3D086.apk

  • Size

    2.5MB

  • MD5

    ebb3f0c1dd02fa60eaae2a881445f903

  • SHA1

    32608b24115e7450dd94305efdfa982e0b6ea4bb

  • SHA256

    814001a82cc709413ba6d301ad65bd32052e4aa493313117e50cfcb419e3d086

  • SHA512

    f01d16e2d8a0611a31692e7a30062981cc8d62229b5d21515bf1fb4a74ec01cfd7c69f5014abbfc3fdbbe29135a3286bfaf62ca74fbc8048184285a1095a2a79

Score
10/10
anubisbankerevasioninfostealertrojan

Malware Config

Extracted

Family

anubis

C2

https://martilerrentcarskirolrte.com/

Signatures

  • Anubis banker

    Android banker that uses overlays.

    bankertrojaninfostealeranubis
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
    evasion

Processes

  • pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Listens for changes in the sensor environment (might be used to detect emulation).
    PID:6815

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json
    Filesize

    1.2MB

    MD5

    75da38c80c34fa099c49b84e4a38f757

    SHA1

    a05c421eaa6d3e9d7d372386e06f467502f2c27a

    SHA256

    fbb237e0110dcfb1f0b54ddb378adc102d468396a781db091217a1d3c6c8c1c2

    SHA512

    e37b3e85c9d59796596063cbd4769054d6eecced7fef8d2d2e1ea6938ab1d1b88f5a4e1c4f165374a5ffe1698938e9a88c970941131874dc3b446ea181a6c6e5

    Download Submit

  • /data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json
    Filesize

    1.2MB

    MD5

    75da38c80c34fa099c49b84e4a38f757

    SHA1

    a05c421eaa6d3e9d7d372386e06f467502f2c27a

    SHA256

    fbb237e0110dcfb1f0b54ddb378adc102d468396a781db091217a1d3c6c8c1c2

    SHA512

    e37b3e85c9d59796596063cbd4769054d6eecced7fef8d2d2e1ea6938ab1d1b88f5a4e1c4f165374a5ffe1698938e9a88c970941131874dc3b446ea181a6c6e5

    Download Submit