anubis | 301da19acf0824798b183c8a0fb7e4a01c3ae7e1f3b70f0d81a68a4c8e3079e4 | Triage

Analysis

max time kernel
678758s
max time network
46s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
03-06-2022 06:36

Sharing

Report Analysis Logs

General

Target

301DA19ACF0824798B183C8A0FB7E4A01C3AE7E1F3B70F0D81A68A4C8E3079E4.apk
Size

273KB
MD5

5cb79cdf431254308e94e14c9049c631
SHA1

a878b8590ce937f824a7994fc2a1557e11a35888
SHA256

301da19acf0824798b183c8a0fb7e4a01c3ae7e1f3b70f0d81a68a4c8e3079e4
SHA512

2b5e0602b9af02f277a2496636960a7e03762f4ae29c9d5166ad970b54e81013da4171ebcab5e6763bd1a9f2a6f7cc39ce7d8eea2de0f37b7679de548a4893e1

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

wocwvy.czyxoxmbauu.slsa

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	wocwvy.czyxoxmbauu.slsa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	wocwvy.czyxoxmbauu.slsa

Acquires the wake lock. 1 IoCs

Processes:

wocwvy.czyxoxmbauu.slsa

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock wocwvy.czyxoxmbauu.slsa
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
evasion

Processes:

wocwvy.czyxoxmbauu.slsa

description ioc process

Framework API call android.hardware.SensorManager.registerListener wocwvy.czyxoxmbauu.slsa

wocwvy.czyxoxmbauu.slsa
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:5312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...