Analysis
-
max time kernel
2558413s -
max time network
162s -
platform
android_x64 -
resource
android-x64-arm64-20220621-en -
submitted
25-06-2022 01:30
Static task
static1
Behavioral task
behavioral1
Sample
3ddb43b421adc9d90502d39ce68a76a3ed9addcc7866f270deb3d8effefa9e4e.apk
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral2
Sample
3ddb43b421adc9d90502d39ce68a76a3ed9addcc7866f270deb3d8effefa9e4e.apk
Resource
android-x64-20220621-en
Behavioral task
behavioral3
Sample
3ddb43b421adc9d90502d39ce68a76a3ed9addcc7866f270deb3d8effefa9e4e.apk
Resource
android-x64-arm64-20220621-en
General
-
Target
3ddb43b421adc9d90502d39ce68a76a3ed9addcc7866f270deb3d8effefa9e4e.apk
-
Size
2.9MB
-
MD5
ac78fe3a2934efdfda73727906502f6a
-
SHA1
ce34fa87b1020f5706b460453922e719b155184f
-
SHA256
3ddb43b421adc9d90502d39ce68a76a3ed9addcc7866f270deb3d8effefa9e4e
-
SHA512
a21633fef057a9c03ced6a941d10bc622cb14ce6e51069087a36a8dcf495d369bdbb431ba6b31cb37b957492ed7199075ff666228f322b9dd0a8827aa35f361e
Malware Config
Extracted
anubis
http://xyz5xyz.ru
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenkdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk -
Acquires the wake lock. 1 IoCs
Processes:
qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenkdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenkioc pid process /data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/PwO.json 4399 qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk /data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/PwO.json 4399 qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk -
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
Processes:
qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenkdescription ioc process Framework API call android.hardware.SensorManager.registerListener qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/PwO.jsonFilesize
1.1MB
MD51bf371df8039cf9dd9969676e3e68cee
SHA17ac73763481f66dc744d1329f983e765b5b530bb
SHA2565b62cd3de8b4303723a11105e369da98bfad52cc7cfbe34065ac896371d10cc1
SHA5127c9f6bf767fcfc56bccc236f0ad98c7af6ecddd2084945201f2bdf22bdc60fae228fad2994460d674eb57dc7d5b0e3e28d8133ddfc6a5c1f5cc9e884145b05f7
-
/data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/PwO.jsonFilesize
1.1MB
MD527c934a731fa515726efdfa96c55bd18
SHA1b24bd3dce2f05ab3b64e342390b80d55dec979c4
SHA2564b0e8c71237a2be2fc8380f87e081cf8ab687f59a1b7455f3095f5fa45bfa2c9
SHA51204959e2a1ae7682151dc1a811a5db23bbd99c0519c30aae0b21f16c6d76b6f3a3b497e9e59d9d35940ec471740d379c52a93599ab1119a60b92bd12e96415602
-
/data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/PwO.jsonFilesize
1.1MB
MD527c934a731fa515726efdfa96c55bd18
SHA1b24bd3dce2f05ab3b64e342390b80d55dec979c4
SHA2564b0e8c71237a2be2fc8380f87e081cf8ab687f59a1b7455f3095f5fa45bfa2c9
SHA51204959e2a1ae7682151dc1a811a5db23bbd99c0519c30aae0b21f16c6d76b6f3a3b497e9e59d9d35940ec471740d379c52a93599ab1119a60b92bd12e96415602
-
/data/user/0/qzabtmqofwaduixtloxxhgmw.eypxexmbx.dayfacukeqdwdenk/app_DynamicOptDex/oat/PwO.json.cur.profMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e