anubis | 889392ed44a613bb3618f6b9a05a663f801c9cd7086ff8d3d7531c3bc57d97be | Triage™

Analysis

max time kernel
2767041s
max time network
163s
platform
android_x64
resource
android-x64-arm64-20220621-en
submitted
27/06/2022, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c522f3527def8ac97958cd2c89a7c29.apk
Size 275KB
Sample220627-nc8graagcp
SHA256 889392ed44a613bb3618f6b9a05a663f801c9cd7086ff8d3d7531c3bc57d97be
MD5 2c522f3527def8ac97958cd2c89a7c29
SHA1 0dab200e6a6d81a80dadd13723bfa4d0a20bcc1a
SHA512 436d402556d8118d36f4079d55160a9649214af60373337cbea448e78592fbf9a9d7e395d51afb7f3520fa3d7274ab6358c5c801904dcdb87cf1388392b22441
MD5 SHA1 SHA512

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	wocwvy.czyxoxmbauu.slsa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	wocwvy.czyxoxmbauu.slsa

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	wocwvy.czyxoxmbauu.slsa

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	wocwvy.czyxoxmbauu.slsa

wocwvy.czyxoxmbauu.slsa
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:4402

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads