Overview

overview

10

Static

static

7

0496F43DCC...84.apk

android_x86

10

0496F43DCC...84.apk

android_x64

10

0496F43DCC...84.apk

android_x64

10

Analysis

  • max time kernel
    678080s
  • max time network
    148s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    03-06-2022 06:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0496F43DCC6C2E25BBF6D05A13E72DADC2AE6397FC617C935FD865F243FFD084.apk

  • Size

    2.6MB

  • MD5

    a1ba897aa937f4fde94652df43432935

  • SHA1

    272b2d9ca67d158d6f2a4635e52593e1d26838a7

  • SHA256

    0496f43dcc6c2e25bbf6d05a13e72dadc2ae6397fc617c935fd865f243ffd084

  • SHA512

    f4befd822b80ca631a648070683923013328755c912ff5623c0dc6b562dc12f1cd55d7a5de95d8c88f884c9f6bf435b0364c7b19d4b6f5737c46bd35e1b06498

Score
10/10
anubisbankerevasioninfostealertrojan

Malware Config

Extracted

Family

anubis

C2

http://92.42.45.152/

Signatures

  • Anubis banker

    Android banker that uses overlays.

    bankertrojaninfostealeranubis
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
    evasion

Processes

  • zjt.spoehyloohrstq.uaeldgadozprbyk
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Listens for changes in the sensor environment (might be used to detect emulation).
    PID:5106
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/oat/x86/CalZ.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:5173

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json
    Filesize

    1.2MB

    MD5

    28432bebd94fb4dc9897c9489164aea3

    SHA1

    a7fef35657be61f0ec35d5e9742c6e0b46727b68

    SHA256

    fa572fb1e6e6e6bad03445643ef6f5256004a8e0dcc11f9c45cb2cfca7ada124

    SHA512

    a5eb0046c8d3b280e0c3c7080d2a645cb9a73918caa47ae95922e3051b13f1497a3426ff288592a8b86136b48c4cdf601d4d4c88d8ce59299b04eeb9111319af

    Download Submit
  • /data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json
    Filesize

    1.2MB

    MD5

    2438d05f0a10628d407c7bab3755f76a

    SHA1

    9c102c7552483372c2a2876bf83172e7bb254a06

    SHA256

    eb4f44de4ca5b9db02d437f4c4b1b05902f007fddd55c5fb226c7524c796b374

    SHA512

    5899e1cf4d9297032e961b5044e192f7728e5f8f6280f32b5ff22abd8c3df6ac0d13b2dcd8f190065f06f5450ae1382d8b216e90f954e274522932644b4f6eb3

    Download Submit
  • /data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json
    Filesize

    1.2MB

    MD5

    4fd88ec6522411859ab95b938bddf67a

    SHA1

    7b0f97c3fab5ccf0cddf22f63e93e21a1e2833e7

    SHA256

    4a883ece6252c46114c45613c120c8df97e42193d92b027292566fefcad352ed

    SHA512

    2e823919305db31cb16e7adefc10b86c5772843b96930e51a4b8f346c79e06fbc1222e09949c6cd2a08b23596b610142d822c37f8032b7d54c98932ac35d83da

    Download Submit
  • /data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json
    Filesize

    1.2MB

    MD5

    2438d05f0a10628d407c7bab3755f76a

    SHA1

    9c102c7552483372c2a2876bf83172e7bb254a06

    SHA256

    eb4f44de4ca5b9db02d437f4c4b1b05902f007fddd55c5fb226c7524c796b374

    SHA512

    5899e1cf4d9297032e961b5044e192f7728e5f8f6280f32b5ff22abd8c3df6ac0d13b2dcd8f190065f06f5450ae1382d8b216e90f954e274522932644b4f6eb3

    Download Submit
  • /data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/oat/CalZ.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/oat/x86/CalZ.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/oat/x86/CalZ.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit