Analysis
-
max time kernel
2344327s -
max time network
148s -
platform
android_x86 -
resource
android-x86-arm-20220621-en -
resource tags
-
submitted
11-08-2022 07:06
General
-
Target
9ea247cfd94b37c29bac67160757a3a8.apk
-
Size
1.3MB
-
MD5
9ea247cfd94b37c29bac67160757a3a8
-
SHA1
1333e1cbfc202f1843235a1d863b385dcfaceeaa
-
SHA256
1136188211805dd4f6e38f163b1debfabb6b11e38a34b3865cfb0f0cd0cccf2d
-
SHA512
57af832042e8d9b33ea65a0cb60f2ca27f54445280ef547efb6844df58a7e065545c2caac87bed45ad3434a1192c9d5f949ab8bef1e6c4dca77d535756221cb8
Malware Config
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Reads information about phone network operator.
-
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
Processes
-
com.still.deal1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.still.deal/app_DynamicOptDex/FD.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.still.deal/app_DynamicOptDex/oat/x86/FD.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179KB
MD525ffc61c06f496f1584742dc000c6796
SHA1c12591c20119c0ff45ade792868d71bc9cebd129
SHA2566c0a73be3ce3a8990f4d3865dc4a668cb1686962a8e60d6ecf8f2ca04cbe12e3
SHA5121086337ea3a7bdc25d7683ce433641be2ee4e84a3c49c1b125abe6c7e0b31a8f753a4df22edcd505d226032f852fa216b3b400600d07906a1b7717f45a9d33d4
-
Filesize
367KB
MD5fd9cdab52346fc42abd7c1d20d6dce8a
SHA1b7c4be891ce3361be762dab3a95b252e78ebcbd6
SHA256935549ed4d0e1c57556be37e25a8c4cfd2eed1d89335b8086fcbd7802f74b3c2
SHA512611bd9746b5610e57507316457d3c43a508a5f3e74e21213c51fd0709c68fc1e589ecb00c427c70914b73b4c5c83f015973f4e15ec626d07b7ee9de2acf58afb
-
Filesize
367KB
MD5480941fc0754921d9b46b071f76c8706
SHA12a79e5127da2f27c42aab1320fa65527d123bb58
SHA256c593c93e7a71a51d6110f8a25f978e8d6a2b5dd34ec05b6a7c461d7880e98547
SHA5129378130f975c1eb0a9349dd112123c85aa7c27c048f60820dc84688f90161d4bd24801612fa01c1bb0d8b0694c0a934efdee9dfd482f2cfeeef9bb43172fbc66