Analysis
-
max time kernel
2558445s -
max time network
38s -
platform
android_x86 -
resource
android-x86-arm-20220621-en -
submitted
25-06-2022 01:32
Static task
static1
Behavioral task
behavioral1
Sample
464e1ba729a7aa989d4fa6c251582460ee434165cd8ca1d48da8f364cf396df7.apk
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral2
Sample
464e1ba729a7aa989d4fa6c251582460ee434165cd8ca1d48da8f364cf396df7.apk
Resource
android-x64-20220621-en
Behavioral task
behavioral3
Sample
464e1ba729a7aa989d4fa6c251582460ee434165cd8ca1d48da8f364cf396df7.apk
Resource
android-x64-arm64-20220621-en
General
-
Target
464e1ba729a7aa989d4fa6c251582460ee434165cd8ca1d48da8f364cf396df7.apk
-
Size
308KB
-
MD5
c828c6590dba54cd63f593da8e09bad0
-
SHA1
147969478d998bde6764cda169dfa3c98152e01a
-
SHA256
464e1ba729a7aa989d4fa6c251582460ee434165cd8ca1d48da8f364cf396df7
-
SHA512
3920cede65169d486e34874dc8ef046334751920c164d3fe7187e657649cb688c9fb52e37930f97297bd289c8f5e308725afd19fc4f6cc902382508a79eb0737
Malware Config
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Makes use of the framework's Accessibility service. 2 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId anubis.bot.myapplication Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText anubis.bot.myapplication -
Acquires the wake lock. 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock anubis.bot.myapplication -
Requests enabling of the accessibility settings. 1 IoCs
description ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS anubis.bot.myapplication -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS anubis.bot.myapplication -
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener anubis.bot.myapplication
Processes
-
anubis.bot.myapplication1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:4549