anubis | b77adec6e50e884b03750944f41d539213d7cc1e9cadd86e76fa0cacf83ad9ed

Analysis

max time kernel
688437s
max time network
163s
platform
android_x64
resource
android-x64-20220310-en
submitted
03-06-2022 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3177d9201c4a177ecbaf0224e7628f3.apk
Size

2.9MB
MD5

c3177d9201c4a177ecbaf0224e7628f3
SHA1

6a545ba1701d17afeb6ecdeb4a7ad7e76c2fd4c6
SHA256

b77adec6e50e884b03750944f41d539213d7cc1e9cadd86e76fa0cacf83ad9ed
SHA512

c77e3c75276550bdb4ded0a069945426445914fe62ca87243e0a03a3148ffc91ab91dce54603bdaad7e85e462f7e70cf698f017019e640bdf694d6cba5927c8d

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Extracted

Family

anubis

https://reazy.dev/

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

pet.error.flock

ioc	pid	process
/data/user/0/pet.error.flock/app_DynamicOptDex/axJqbh.json	6188	pet.error.flock
/data/user/0/pet.error.flock/app_DynamicOptDex/axJqbh.json	6188	pet.error.flock

Reads information about phone network operator.
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
evasion

Processes:

pet.error.flock

description ioc process

Framework API call android.hardware.SensorManager.registerListener pet.error.flock

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	pet.error.flock

pet.error.flock
1⤵
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:6188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/pet.error.flock/app_DynamicOptDex/axJqbh.json
Filesize
1.0MB

MD5
e6d07759f8455a8d25ef991c33d6d1d0

SHA1
036bc8d6bf8f10115d5b0751bb1a57a99b0d1853

SHA256
36fb5c9a3314d96acd8937a41d2dfc80498c8ba1500c0d935fdbcfba59aaa9d5

SHA512
b5d4e00a3684d197c84fcff59e9fbcdbaf04cf15112e6723f6cc92638b677f15ab0020610c167972f2856d561e07fa401b03d180145348396c585bd440e8cc05

Download Submit
/data/user/0/pet.error.flock/app_DynamicOptDex/axJqbh.json
Filesize
1.0MB

MD5
95bc1301edbb149a75f083c9953d715b

SHA1
ba772f7dd96dec8a9705b61a37446a8b94a3261f

SHA256
852b78d2a6712a323b463d697e538acea592ff34948ae3c337c7c7d5942be5e2

SHA512
3811eabbbdf3f512250256195bc386ad1e9b18a23d7fb9810133beed83efed25528b15b9ee1a987707c10d8bd6acec97561d0eec4a166265bed07d0b36b6b7fc

Download Submit
/data/user/0/pet.error.flock/app_DynamicOptDex/axJqbh.json
Filesize
1.0MB

MD5
95bc1301edbb149a75f083c9953d715b

SHA1
ba772f7dd96dec8a9705b61a37446a8b94a3261f

SHA256
852b78d2a6712a323b463d697e538acea592ff34948ae3c337c7c7d5942be5e2

SHA512
3811eabbbdf3f512250256195bc386ad1e9b18a23d7fb9810133beed83efed25528b15b9ee1a987707c10d8bd6acec97561d0eec4a166265bed07d0b36b6b7fc

Download Submit
/data/user/0/pet.error.flock/app_DynamicOptDex/oat/axJqbh.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit