anubis | 36e2b02806cad49548927bed346c0e42c297574e832fb87d3180acf5d0df1793

Analysis

max time kernel
2794057s
max time network
123s
platform
android_x64
resource
android-x64-arm64-20220621-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system
submitted
16-08-2022 12:01

Target

36e2b02806cad49548927bed346c0e42c297574e832fb87d3180acf5d0df1793.apk
Size

430KB
MD5

b23c66be16b001f62bbfc03a2ee0b6d1
SHA1

d18dbd992d04ef20f2cbbce33822f5dd1e9fb23a
SHA256

36e2b02806cad49548927bed346c0e42c297574e832fb87d3180acf5d0df1793
SHA512

38dc38ab3a3adb0c44ecde60ae06271b74123f3b6adee282988b958b5e37a42e0c971f1d5ec380484e1b6150b11e5fc5e93b5bac2039d76c89c7d748e96c8ad6

Score

10^/10

Family

anubis

http://217.69.13.77

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	wocwvy.czyxoxmbauu.slsa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	wocwvy.czyxoxmbauu.slsa

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	wocwvy.czyxoxmbauu.slsa

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/wocwvy.czyxoxmbauu.slsa/app_ded/TnEKufx0e2m3IdnkPNpKRTfAJzPRJykT.dex	4757	wocwvy.czyxoxmbauu.slsa
/data/user/0/wocwvy.czyxoxmbauu.slsa/app_ded/TnEKufx0e2m3IdnkPNpKRTfAJzPRJykT.dex	4757	wocwvy.czyxoxmbauu.slsa

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	wocwvy.czyxoxmbauu.slsa

/data/user/0/wocwvy.czyxoxmbauu.slsa/app_ded/TnEKufx0e2m3IdnkPNpKRTfAJzPRJykT.dex

Filesize
271KB

MD5
c3d254a785f149f0f264b8e798d4f175

SHA1
e42732ff9b687818f3bdefbf9dd2f1d57e39b18c

SHA256
73e3d21aa3ce0b00f909902bbfeb484aa97dc8d6b884ca06f9caea009c395037

SHA512
14caf82fcc68e4959605d0fb2a47456fba5e49de1a2699928d5c7813f8536c018823695d2b270f435636bf0a7b004a3b764316b18d0b2556f1e2f76904cb5a17

Download Submit
/data/user/0/wocwvy.czyxoxmbauu.slsa/app_ded/TnEKufx0e2m3IdnkPNpKRTfAJzPRJykT.dex

Filesize
271KB

MD5
c3d254a785f149f0f264b8e798d4f175

SHA1
e42732ff9b687818f3bdefbf9dd2f1d57e39b18c

SHA256
73e3d21aa3ce0b00f909902bbfeb484aa97dc8d6b884ca06f9caea009c395037

SHA512
14caf82fcc68e4959605d0fb2a47456fba5e49de1a2699928d5c7813f8536c018823695d2b270f435636bf0a7b004a3b764316b18d0b2556f1e2f76904cb5a17

Download Submit
/data/user/0/wocwvy.czyxoxmbauu.slsa/app_ded/TnEKufx0e2m3IdnkPNpKRTfAJzPRJykT.dex

Filesize
271KB

MD5
c3d254a785f149f0f264b8e798d4f175

SHA1
e42732ff9b687818f3bdefbf9dd2f1d57e39b18c

SHA256
73e3d21aa3ce0b00f909902bbfeb484aa97dc8d6b884ca06f9caea009c395037

SHA512
14caf82fcc68e4959605d0fb2a47456fba5e49de1a2699928d5c7813f8536c018823695d2b270f435636bf0a7b004a3b764316b18d0b2556f1e2f76904cb5a17

Download Submit