zanubis | 0198b8fa11bf9e8442defa00befa2ab224ada5ebb4a60256f2bf5fc491cca0a1

Resubmissions

19-10-2022 07:24

221019-h8nvbsfehl 10

13-09-2022 08:50

220913-krtqcsfbc9 8

02-09-2022 10:02

220902-l2sfqacadq 8

Analysis

max time kernel
4012092s
max time network
144s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
19-10-2022 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0198b8fa11bf9e8442defa00befa2ab224ada5ebb4a60256f2bf5fc491cca0a1.apk
Size

4.0MB
MD5

0b3248698651c68aa79c128c26df6f5c
SHA1

93be818f6087423909594f5630b67cf0ddcf71b6
SHA256

0198b8fa11bf9e8442defa00befa2ab224ada5ebb4a60256f2bf5fc491cca0a1
SHA512

c9815d347d65cb2184a50b9e0bc6086dd77023666189b69baabfe3e21e7cebaae513c7530c96af877bd0ef03f1f946a23f947bcaafc4be7d89d967bb9d3dbfa4
SSDEEP

98304:rAf1Qd2ofrWriq/urhQuzI6TZS+DixH8bU4bFLzbcHeze8:rANZLky4To+mgU4bFLq8

Score

10^/10

zanubis banker evasion infostealer trojan

Malware Config

Extracted

Family

zanubis

Signatures

Zanubis
Zanubis is an Android banking malware first seen in 2022.
infostealer trojan banker zanubis

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.personal.pdf

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.personal.pdf
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.personal.pdf

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.personal.pdf

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.personal.pdf
Acquires the wake lock. 1 IoCs

Processes:

com.personal.pdf

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.personal.pdf

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.personal.pdf

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.personal.pdf

Requests disabling of battery optimizations (often used to enable hiding in the background). 2 IoCs

evasion

Processes:

com.personal.pdf:remotecom.personal.pdf

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.personal.pdf:remote
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.personal.pdf

Removes a system notification. 1 IoCs
evasion

Processes:

com.personal.pdf

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.personal.pdf

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.personal.pdf

com.personal.pdf
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4024

com.personal.pdf:remote
1⤵
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4309

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.personal.pdf/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.personal.pdf/app_webview/Cookies-journal

Filesize
1KB

MD5
d44da464fb9836b100349d9973997c44

SHA1
5a88d3d372340bb419e04c4cf01a9e9532e4ca1d

SHA256
2fa25e990dcc849bf8d608810006da4adc27430ddf421cf24a1160ce7e766231

SHA512
6b682cbc8ee1aa91fd41776dd022dc3734455d07bbb63d7952971b26039822d401bffdf95fb568340dc3e3254006de24690fc31359e49ebaca2a41c438471170

Download Submit
/data/user/0/com.personal.pdf/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.personal.pdf/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
540accd04c4e1fe0d39f1510948403e5

SHA1
d6667e0d8080c47166c2262a58321b514106db08

SHA256
f1c01a12e118bf571c6e467c01e845bbdb555fb67d7bd3310afdb13105459631

SHA512
cd437d059daa85ebb4260bc3f7489442c98086e3c38fac89d1bc8a5c3e11c7652b1fe3bc7a0b9b43796999780489d43ff9afa239ea0076b2bbaf5246d7a11554

Download Submit
/data/user/0/com.personal.pdf/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.personal.pdf/app_webview/Web Data-journal

Filesize
1KB

MD5
74d0c2f2e96c8e7b6a9f005f8eb34b25

SHA1
461f44e23909e476dcfd3640c8e96dc67e1f3a2f

SHA256
315c6388f46693c497d517ce27e2aff8752753a4de7c96e0c9f892ffcad979f4

SHA512
1d7f20e361e5a938685f779430b23dfa17fe507c60c1b6b16ba9f13bd75cd707cc01817435205d050725c5be25e216ea403eb4b30acc2bee96f57986b8ea399f

Download Submit
/data/user/0/com.personal.pdf/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.personal.pdf/app_webview/metrics_guid

Filesize
36B

MD5
6108ac9468d3c3c57165efdc2408dcdc

SHA1
ce1682e6d08f569c13d485551631c2e7dd0265e7

SHA256
c3524c340f82a89452923a315f218ff014d5cb8aa1bab484254ccf6ce87db1c4

SHA512
d1616aa78cec7f76f1d73bc5b0db3a94b550e89df4e5b05b27258a2166f9a521f7d49b3418dfe9cfed4833be4ae9d6e8477087b2dd49a87460804e434ad560c4

Download Submit
/data/user/0/com.personal.pdf/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.personal.pdf/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.personal.pdf/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.personal.pdf/cache/org.chromium.android_webview/44e5652fb145311f_0

Filesize
1KB

MD5
7078b0a1ee195ca902e32b5fd312fb2c

SHA1
7d1a2a37b0fa396dd1049f3ad78b19ab1da05a9f

SHA256
098150168192569c4c4d83bf9065c7471b9d126e5d78849568d6f42f9ccad9b6

SHA512
a88144a660b4812c35d7ac61e3e733e6e75db2d569821ecbd7372ac6a46a6d2272aa4d2a59f3329da9ba0e50b81b1dd7ade83b5ff803830d11528b3d758e3843

Download Submit
/data/user/0/com.personal.pdf/cache/org.chromium.android_webview/f7dc77863b8aa457_0

Filesize
548B

MD5
908a1ca89e0b1b195e47eaac7ab720af

SHA1
87fc501931583380e4fa7493015e136a862e89cf

SHA256
e7540a23089fe0e1665e5932d5793bd7890619c6969eba876edfdbe1bd9fe29e

SHA512
658a314c3134e8e50ebd2a47071337d8c0f75bce225a4e6410bf59b92dc5db31ca764e1ecfc0a094379c47859f234379084e390c030eb97dae4e262cdbd536ea

Download Submit
/data/user/0/com.personal.pdf/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.personal.pdf/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
97e6b492cbc7433da5b244ee8002bef9

SHA1
a20c520f1db219f61ced3481534b2cef498a0438

SHA256
cf7fde6b84934009987af79ed985115eb78d2b7813383bcabf9961593c898f06

SHA512
c302e24ffc71895f0e4942d62b16ddeb68962d0fcdcc7e906434b3c0792beecd17569dcd133a1d533d1f1d7c11f723d008237949352fce7b283342788b086409

Download Submit
/data/user/0/com.personal.pdf/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
96B

MD5
66cd7ea74361c4e71b61e126df350915

SHA1
6e073c4f9aeab4499d279a144a2337ce96ed815b

SHA256
4be06285cec368eef2f4573c2238c907701f440cc8afef252b7fb70badf0e744

SHA512
054bf61d6267f58acf1c2e6a7d848eca0b9d8e8ee7fb4685777f6981ed80c84dd69a9eeeb331a01c7917aa93f46e0ba71fa73ed2b04876bd538f0b63921a4d0f

Download Submit
/data/user/0/com.personal.pdf/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit