Analysis
-
max time kernel
3294596s -
max time network
119s -
platform
android_x64 -
resource
android-x64-arm64-20220621-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system -
submitted
22-08-2022 07:04
Static task
static1
Behavioral task
behavioral1
Sample
a3ffaeed53114c189522393e4c24bddc.apk
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral2
Sample
a3ffaeed53114c189522393e4c24bddc.apk
Resource
android-x64-20220621-en
Behavioral task
behavioral3
Sample
a3ffaeed53114c189522393e4c24bddc.apk
Resource
android-x64-arm64-20220621-en
General
-
Target
a3ffaeed53114c189522393e4c24bddc.apk
-
Size
258KB
-
MD5
a3ffaeed53114c189522393e4c24bddc
-
SHA1
98fe874c4321f717cd773772fd1ac366b660ae3e
-
SHA256
781f2d494faa4fc861aee91c2925afd6468a537082d18c9ebb85e050bd7b5f89
-
SHA512
450b893a8c0b6a06c80c19a96540431c7cbc7ab42dcb0295d4d89851af625fce6dc26b2a704f93dae4615fcc2b95b72f200db0c94214e8a4e53fbd3c9ac5d9d6
Malware Config
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
app.online.myapplicationdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId app.online.myapplication Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText app.online.myapplication -
Acquires the wake lock. 1 IoCs
Processes:
app.online.myapplicationdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock app.online.myapplication -
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
Processes:
app.online.myapplicationdescription ioc process Framework API call android.hardware.SensorManager.registerListener app.online.myapplication