Resubmissions
27-06-2022 10:36
220627-mnd7lsaebl 10Analysis
-
max time kernel
2763792s -
max time network
57s -
platform
android_x64 -
resource
android-x64-20220621-en -
submitted
27-06-2022 10:36
Static task
static1
Behavioral task
behavioral1
Sample
8ae20794d2fc7659a003d5debd6970d8-1.apk
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral2
Sample
8ae20794d2fc7659a003d5debd6970d8-1.apk
Resource
android-x64-20220621-en
Behavioral task
behavioral3
Sample
8ae20794d2fc7659a003d5debd6970d8-1.apk
Resource
android-x64-arm64-20220621-en
General
-
Target
8ae20794d2fc7659a003d5debd6970d8-1.apk
-
Size
1.9MB
-
MD5
8ae20794d2fc7659a003d5debd6970d8
-
SHA1
7aadc3e33871db0111a32c5b0bf68ec8db7860e5
-
SHA256
9c7b234d0d46169dcefb9f5b22c5df134b1a120b67666c071feaf97a6078d1a1
-
SHA512
30f1bbb28cfc2ad105e2f86302f124fa60c0fd382f245b0be829710e9fdd29d347ae8063431158445f4877b3c4062c4d664e87779f1eae50d1cc2bb37fcc646d
Malware Config
Extracted
anubis
http://old.mandamientos.ga
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json 5330 gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw /data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json 5330 gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json
Filesize1.0MB
MD5cb9df5c68e588e64aec0dc13fff5d918
SHA1db665796ff8b5d029bb661caf0118f5f3cb143aa
SHA256d073367064a20c35f08a59adcefd7bb017e567a36b26913ce22e8f2acfd1f8fb
SHA5127007874302d06c01e086e50105f941cd6b14e7916aae6071746026908ba9e486e97f51bd96279d633f7c181623600fcdff9f0efd49531b86ff0fcde225079280
-
/data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json
Filesize1.0MB
MD58b4f731ed2aa6bfe3042e1183e83c60e
SHA1a90dca5eac7130025abb00a666ca190590776c30
SHA2568306aed35abe6dd4105d060a4ccb1afcb87cc97cb2444c03ebf320810706089e
SHA51212db81a65b170ef03f07d9cc441f06dced2776ca0a57cc3205fcdb934814a48bd8670eabd8352ad5f27277a620fc4bae6e36986c5f9c03a346e1051ad74b58bb
-
/data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json
Filesize1.0MB
MD58b4f731ed2aa6bfe3042e1183e83c60e
SHA1a90dca5eac7130025abb00a666ca190590776c30
SHA2568306aed35abe6dd4105d060a4ccb1afcb87cc97cb2444c03ebf320810706089e
SHA51212db81a65b170ef03f07d9cc441f06dced2776ca0a57cc3205fcdb934814a48bd8670eabd8352ad5f27277a620fc4bae6e36986c5f9c03a346e1051ad74b58bb