anubis | abb57296e77de0d4e49232a35a89363b3f9772d809007279502f0236cd24ea2e | Triage

Analysis

max time kernel
685717s
max time network
176s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
03-06-2022 07:55

Sharing

Report Analysis Logs

General

Target

ABB57296E77DE0D4E49232A35A89363B3F9772D809007279502F0236CD24EA2E.apk
Size

269KB
MD5

9487e238e54cd454615296725e443656
SHA1

0e92a3f418d42b309aeb37ba23c9f554bc0459b9
SHA256

abb57296e77de0d4e49232a35a89363b3f9772d809007279502f0236cd24ea2e
SHA512

df835ca34c6605727787dd66809ffab1584a5065b0f31e2acb4b94601c0ecb38eed558223619ac322586f2465e19bab7998d6ddb3bf632d04190975e4231e32b

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

wocwvy.czyxoxmbauu.slsa

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	wocwvy.czyxoxmbauu.slsa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	wocwvy.czyxoxmbauu.slsa

Acquires the wake lock. 1 IoCs

Processes:

wocwvy.czyxoxmbauu.slsa

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock wocwvy.czyxoxmbauu.slsa
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
evasion

Processes:

wocwvy.czyxoxmbauu.slsa

description ioc process

Framework API call android.hardware.SensorManager.registerListener wocwvy.czyxoxmbauu.slsa

wocwvy.czyxoxmbauu.slsa
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:6221

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...