anubis | a4fcda220e35e44aa9bd48b3aa9e63418a4ee4736105cd42dbf75c388d90edc3 | Triage

Analysis

max time kernel
3294382s
max time network
136s
platform
android_x64
resource
android-x64-arm64-20220621-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system
submitted
22-08-2022 07:00

Sharing

Report Analysis Logs

General

Target

946ba753abc3e2cc380af531b68bd108.apk
Size

258KB
MD5

946ba753abc3e2cc380af531b68bd108
SHA1

8bf8a4d11ea1dc477b97b26eefac7511749e9d83
SHA256

a4fcda220e35e44aa9bd48b3aa9e63418a4ee4736105cd42dbf75c388d90edc3
SHA512

2d6f0779224e952f231a571b7d1f25bb0e3bd24fb0185fd7db73c03039e6508780bc2d5f6a5a5788374078e4606b765a6ad3575b0ec98906aa95e115fb916766

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

app.online.myapplication

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	app.online.myapplication
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	app.online.myapplication

Acquires the wake lock. 1 IoCs

Processes:

app.online.myapplication

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock app.online.myapplication
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
evasion

Processes:

app.online.myapplication

description ioc process

Framework API call android.hardware.SensorManager.registerListener app.online.myapplication

app.online.myapplication
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:4166

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...