anubis | 814001a82cc709413ba6d301ad65bd32052e4aa493313117e50cfcb419e3d086

General

Target

814001A82CC709413BA6D301AD65BD32052E4AA493313117E50CFCB419E3D086.apk
Size

2.5MB
MD5

ebb3f0c1dd02fa60eaae2a881445f903
SHA1

32608b24115e7450dd94305efdfa982e0b6ea4bb
SHA256

814001a82cc709413ba6d301ad65bd32052e4aa493313117e50cfcb419e3d086
SHA512

f01d16e2d8a0611a31692e7a30062981cc8d62229b5d21515bf1fb4a74ec01cfd7c69f5014abbfc3fdbbe29135a3286bfaf62ca74fbc8048184285a1095a2a79

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Extracted

Family

anubis

C2

https://martilerrentcarskirolrte.com/

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json	5075	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr
/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json	5154	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/oat/x86/Fg.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json	5075	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr

Reads information about phone network operator.

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr

pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:5075
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/oat/x86/Fg.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5154

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json

Filesize
1.2MB

MD5
ffb7b0eab9e8ad8e78a3381e08ba8eb2

SHA1
0da7b6813dc505c317a2bbae88c3c52eb55e9849

SHA256
ae1a46741a3008bb7468330fca80669fdf8b3c5e339eecf12d1114b58f1ab594

SHA512
b5426d9731355102de5740ed66e7777dc10b32d30164091278c3c7220fd5efaf375f07882124edb0deab7d66d6edc11e0f5e5744656fb2bc98fe5474ddeea9fa

Download Submit
/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json

Filesize
1.2MB

MD5
75da38c80c34fa099c49b84e4a38f757

SHA1
a05c421eaa6d3e9d7d372386e06f467502f2c27a

SHA256
fbb237e0110dcfb1f0b54ddb378adc102d468396a781db091217a1d3c6c8c1c2

SHA512
e37b3e85c9d59796596063cbd4769054d6eecced7fef8d2d2e1ea6938ab1d1b88f5a4e1c4f165374a5ffe1698938e9a88c970941131874dc3b446ea181a6c6e5

Download Submit
/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json

Filesize
1.2MB

MD5
3dec70ed5132e4b6f09c18b6c2316f97

SHA1
3d4ab97903d3b9f237e93976339556739f31aa1e

SHA256
2287ce209bfe100b61033e8e559d3caf5b0cc4d2dbcc4946368d33a608472f41

SHA512
b70ab9ee9d41eef9b4a33eeab973b9addf4fd664744084a24ad12ff621f57888c96239a8a48d4d19aa3c2b8d9d10d2f2ce769bb82a01401b6e80e6524287eaed

Download Submit
/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json

Filesize
1.2MB

MD5
75da38c80c34fa099c49b84e4a38f757

SHA1
a05c421eaa6d3e9d7d372386e06f467502f2c27a

SHA256
fbb237e0110dcfb1f0b54ddb378adc102d468396a781db091217a1d3c6c8c1c2

SHA512
e37b3e85c9d59796596063cbd4769054d6eecced7fef8d2d2e1ea6938ab1d1b88f5a4e1c4f165374a5ffe1698938e9a88c970941131874dc3b446ea181a6c6e5

Download Submit

Analysis

Sharing