anubis | c38c675a4342052a18e969e839cce797fef842b9d53032882966a3731ced0a70 | Triage

Analysis

max time kernel
2761574s
max time network
158s
platform
android_x64
resource
android-x64-arm64-20220621-en
submitted
27-06-2022 09:55

Sharing

Report Analysis Logs

General

Target

c38c675a4342052a18e969e839cce797fef842b9d53032882966a3731ced0a70.apk
Size

561KB
MD5

c027ec0f9855529877bc0d57453c5e86
SHA1

7b5e31a41c9220330146d8a173b21512971c74a2
SHA256

c38c675a4342052a18e969e839cce797fef842b9d53032882966a3731ced0a70
SHA512

78c12d46dc15ce52cc1ccbedd8b1762f6a594b44e72c80974eec19dc575b07f0db994b568ec78ab51ccdbf02e93ba0dff9f3b1a5f59cb694bed454baf2ac97a4

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	wocwvy.czyxoxmbauu.slsa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	wocwvy.czyxoxmbauu.slsa

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	wocwvy.czyxoxmbauu.slsa

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	wocwvy.czyxoxmbauu.slsa

wocwvy.czyxoxmbauu.slsa
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:4859

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads