anubis | 003df8738942a88d690aeb902744cec2dc2e671c708e96cb1085b13bdbd6823a

General

Target

003DF8738942A88D690AEB902744CEC2DC2E671C708E96CB1085B13BDBD6823A.apk
Size

2.5MB
MD5

e5dec445c7a8ca93cec39f87ab86557d
SHA1

6f0869d158b3e06a4d20af5d64ff6eeddcff6aaf
SHA256

003df8738942a88d690aeb902744cec2dc2e671c708e96cb1085b13bdbd6823a
SHA512

56c7416908ac6782459ad335ccc79d9a6912e3ddfee51a13bc91fefbd579879e47002ad0c733ffeeb35329dda264292c7bc9d0343c7d17166ad2f368d0db3f68

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Extracted

Family

anubis

C2

http://matilarsevilir.com

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim/app_DynamicOptDex/kDyp.json	5106	bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim
/data/user/0/bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim/app_DynamicOptDex/kDyp.json	5163	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim/app_DynamicOptDex/kDyp.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim/app_DynamicOptDex/oat/x86/kDyp.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim/app_DynamicOptDex/kDyp.json	5106	bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim

Reads information about phone network operator.

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim

bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:5106
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim/app_DynamicOptDex/kDyp.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim/app_DynamicOptDex/oat/x86/kDyp.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5163

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim/app_DynamicOptDex/kDyp.json

Filesize
1006KB

MD5
e65f8eb321ca7c3eb3b05557b7fbed19

SHA1
13acc25165f4292b691db7870f91b24e53ea1543

SHA256
e511008a7e68502f6422a84ae9e67a867c70d09cdac573500c3a225fedff5ed5

SHA512
48aec31e96c67e4d4d04d62d35009e23ec97cbfbe81f2e270be6345715152623716e18588d90f97dddbbc0166ac37f0e713fb2ff8b04e662277ed10cf96be388

Download Submit
/data/user/0/bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim/app_DynamicOptDex/kDyp.json

Filesize
1006KB

MD5
522b2f0e1b375c5457c6b033d909c601

SHA1
d4e08c74765c70fde2af958b7c8a0dc8ec519b4e

SHA256
3522388638887a067a818a3b4fca6eea14ad1be6c9df12ad402e1c9f85230788

SHA512
2ad8ea15bba77570198272e169eb9e1da207a4b75dade6895e39f08488ca45f758d24787cd9db7f259f3c4878533fe4e561992598d23e1997daf620c631cb431

Download Submit
/data/user/0/bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim/app_DynamicOptDex/kDyp.json

Filesize
1006KB

MD5
e62fb7e807ca926a5e9f6cc518990f04

SHA1
3566041008e73463e90dddc1e5736813bd61c1fd

SHA256
40b77064ba548559252520a8ae5601bcdc79f3877ab8492b8dd9ebf9e239adb6

SHA512
75d72a6e3b407dcbf9fda1085edc749f62627eef48132dfa0f31ffe1da10e369537f83436a495fa47f3adb07c5511f996779e1b9d22645d94cf1029a432e5177

Download Submit
/data/user/0/bnamglgudtkwoa.xwnljk.wlfpsmqqgumeoynlourim/app_DynamicOptDex/kDyp.json

Filesize
1006KB

MD5
522b2f0e1b375c5457c6b033d909c601

SHA1
d4e08c74765c70fde2af958b7c8a0dc8ec519b4e

SHA256
3522388638887a067a818a3b4fca6eea14ad1be6c9df12ad402e1c9f85230788

SHA512
2ad8ea15bba77570198272e169eb9e1da207a4b75dade6895e39f08488ca45f758d24787cd9db7f259f3c4878533fe4e561992598d23e1997daf620c631cb431

Download Submit

Analysis

Sharing