anubis | 464e1ba729a7aa989d4fa6c251582460ee434165cd8ca1d48da8f364cf396df7 | Triage

Analysis

max time kernel
2558578s
max time network
158s
platform
android_x64
resource
android-x64-arm64-20220621-en
submitted
25-06-2022 01:32

Sharing

Report Analysis Logs

General

Target

464e1ba729a7aa989d4fa6c251582460ee434165cd8ca1d48da8f364cf396df7.apk
Size

308KB
MD5

c828c6590dba54cd63f593da8e09bad0
SHA1

147969478d998bde6764cda169dfa3c98152e01a
SHA256

464e1ba729a7aa989d4fa6c251582460ee434165cd8ca1d48da8f364cf396df7
SHA512

3920cede65169d486e34874dc8ef046334751920c164d3fe7187e657649cb688c9fb52e37930f97297bd289c8f5e308725afd19fc4f6cc902382508a79eb0737

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	anubis.bot.myapplication
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	anubis.bot.myapplication

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	anubis.bot.myapplication

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	anubis.bot.myapplication

anubis.bot.myapplication
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:4332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads