anubis | b64d89dabdf29549501f7529af251170a7c1dab8046f291d964b6925f7727123 | Triage

Analysis

max time kernel
683888s
max time network
144s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
03-06-2022 08:49

Sharing

Report Analysis Logs

General

Target

B64D89DABDF29549501F7529AF251170A7C1DAB8046F291D964B6925F7727123.apk
Size

273KB
MD5

e1aa5e8021689e4c43c84b9d97fc739a
SHA1

9aa51d6350fe20d9d435153a0375e1ee0f5bac58
SHA256

b64d89dabdf29549501f7529af251170a7c1dab8046f291d964b6925f7727123
SHA512

b200c9d4d95bb71faa85873e137368304f0764b5a8d514abb03ae76204f69da5aa1c4c5eb3a4624174e5cce6a5e10f5b392684f88702e8e8cee9123d4e8b3aa2

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

wocwvy.czyxoxmbauu.slsa

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	wocwvy.czyxoxmbauu.slsa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	wocwvy.czyxoxmbauu.slsa

Acquires the wake lock. 1 IoCs

Processes:

wocwvy.czyxoxmbauu.slsa

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock wocwvy.czyxoxmbauu.slsa
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
evasion

Processes:

wocwvy.czyxoxmbauu.slsa

description ioc process

Framework API call android.hardware.SensorManager.registerListener wocwvy.czyxoxmbauu.slsa

wocwvy.czyxoxmbauu.slsa
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:6235

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...