anubis | 0496f43dcc6c2e25bbf6d05a13e72dadc2ae6397fc617c935fd865f243ffd084

Analysis

max time kernel
677645s
max time network
166s
platform
android_x64
resource
android-x64-20220310-en
submitted
03-06-2022 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0496F43DCC6C2E25BBF6D05A13E72DADC2AE6397FC617C935FD865F243FFD084.apk
Size

2.6MB
MD5

a1ba897aa937f4fde94652df43432935
SHA1

272b2d9ca67d158d6f2a4635e52593e1d26838a7
SHA256

0496f43dcc6c2e25bbf6d05a13e72dadc2ae6397fc617c935fd865f243ffd084
SHA512

f4befd822b80ca631a648070683923013328755c912ff5623c0dc6b562dc12f1cd55d7a5de95d8c88f884c9f6bf435b0364c7b19d4b6f5737c46bd35e1b06498

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Extracted

Family

anubis

http://92.42.45.152/

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

zjt.spoehyloohrstq.uaeldgadozprbyk

ioc	pid	process
/data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json	6194	zjt.spoehyloohrstq.uaeldgadozprbyk
/data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json	6194	zjt.spoehyloohrstq.uaeldgadozprbyk

Reads information about phone network operator.
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
evasion

Processes:

zjt.spoehyloohrstq.uaeldgadozprbyk

description ioc process

Framework API call android.hardware.SensorManager.registerListener zjt.spoehyloohrstq.uaeldgadozprbyk

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	zjt.spoehyloohrstq.uaeldgadozprbyk

zjt.spoehyloohrstq.uaeldgadozprbyk
1⤵
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:6194

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json
Filesize
1.2MB

MD5
28432bebd94fb4dc9897c9489164aea3

SHA1
a7fef35657be61f0ec35d5e9742c6e0b46727b68

SHA256
fa572fb1e6e6e6bad03445643ef6f5256004a8e0dcc11f9c45cb2cfca7ada124

SHA512
a5eb0046c8d3b280e0c3c7080d2a645cb9a73918caa47ae95922e3051b13f1497a3426ff288592a8b86136b48c4cdf601d4d4c88d8ce59299b04eeb9111319af

Download Submit
/data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json
Filesize
1.2MB

MD5
2438d05f0a10628d407c7bab3755f76a

SHA1
9c102c7552483372c2a2876bf83172e7bb254a06

SHA256
eb4f44de4ca5b9db02d437f4c4b1b05902f007fddd55c5fb226c7524c796b374

SHA512
5899e1cf4d9297032e961b5044e192f7728e5f8f6280f32b5ff22abd8c3df6ac0d13b2dcd8f190065f06f5450ae1382d8b216e90f954e274522932644b4f6eb3

Download Submit
/data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json
Filesize
1.2MB

MD5
2438d05f0a10628d407c7bab3755f76a

SHA1
9c102c7552483372c2a2876bf83172e7bb254a06

SHA256
eb4f44de4ca5b9db02d437f4c4b1b05902f007fddd55c5fb226c7524c796b374

SHA512
5899e1cf4d9297032e961b5044e192f7728e5f8f6280f32b5ff22abd8c3df6ac0d13b2dcd8f190065f06f5450ae1382d8b216e90f954e274522932644b4f6eb3

Download Submit
/data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/oat/CalZ.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit