zanubis | 0198b8fa11bf9e8442defa00befa2ab224ada5ebb4a60256f2bf5fc491cca0a1

Resubmissions

19-10-2022 07:24

221019-h8nvbsfehl 10

13-09-2022 08:50

220913-krtqcsfbc9 8

02-09-2022 10:02

220902-l2sfqacadq 8

Analysis

max time kernel
4012095s
max time network
161s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
19-10-2022 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0198b8fa11bf9e8442defa00befa2ab224ada5ebb4a60256f2bf5fc491cca0a1.apk
Size

4.0MB
MD5

0b3248698651c68aa79c128c26df6f5c
SHA1

93be818f6087423909594f5630b67cf0ddcf71b6
SHA256

0198b8fa11bf9e8442defa00befa2ab224ada5ebb4a60256f2bf5fc491cca0a1
SHA512

c9815d347d65cb2184a50b9e0bc6086dd77023666189b69baabfe3e21e7cebaae513c7530c96af877bd0ef03f1f946a23f947bcaafc4be7d89d967bb9d3dbfa4
SSDEEP

98304:rAf1Qd2ofrWriq/urhQuzI6TZS+DixH8bU4bFLzbcHeze8:rANZLky4To+mgU4bFLq8

Score

10^/10

zanubis banker evasion infostealer trojan

Malware Config

Extracted

Family

zanubis

Signatures

Zanubis
Zanubis is an Android banking malware first seen in 2022.
infostealer trojan banker zanubis

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.personal.pdf

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.personal.pdf
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.personal.pdf

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.personal.pdf

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.personal.pdf
Acquires the wake lock. 1 IoCs

Processes:

com.personal.pdf

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.personal.pdf

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.personal.pdf

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.personal.pdf

Requests disabling of battery optimizations (often used to enable hiding in the background). 2 IoCs

evasion

Processes:

com.personal.pdf:remotecom.personal.pdf

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.personal.pdf:remote
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.personal.pdf

Removes a system notification. 1 IoCs
evasion

Processes:

com.personal.pdf

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.personal.pdf

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.personal.pdf

com.personal.pdf
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4556

com.personal.pdf:remote
1⤵
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4718

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.personal.pdf/app_webview/.com.google.Chrome.h58uPK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/Cookies

Filesize
64KB

MD5
dfb2098ca7b3bf16d6f5f1e7d3839af5

SHA1
ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

SHA256
e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

SHA512
fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/Cookies-journal

Filesize
1KB

MD5
426464dba9f4dd6624182795aff52400

SHA1
e2bb4b5bc0ccae36f7696719743c659a23b52757

SHA256
da2663ddaff114782890f875b8a9aff839562766be3f278f62fa36be1eaf374a

SHA512
b9ba687d673fd6650a766a22d816b3f08570cc70358a6f1a6ed36a4d927cba9ebb6231bb77a939fcddfb5633d8fc2a8e6eb8f4a8691a94b3cfc0cf05f92daa0e

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
a1b4f8660674ad7cb616a521f4ed8a34

SHA1
236a19d3b0b8fd9ce9f2a32dd17f2f17435eb23f

SHA256
39866de9ff0c53a256f3520792425b493b2539d20d0207b3c9f667d6dd465a72

SHA512
339f4d5c4ac76b901c486c7e255408e030a774a7104483f65b87d95883ffd795b042079e7b9d0125e5a914ee89a05918d40601bafc0f8bec834bca5d4c4a2700

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/Session Storage/000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/Session Storage/000003.log

Filesize
61B

MD5
9f7eadc15e13d0608b4e4d590499ae2e

SHA1
afb27f5c20b117031328e12dd3111a7681ff8db5

SHA256
5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923

SHA512
88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/Session Storage/LOCK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/Session Storage/LOG

Filesize
128B

MD5
9954876fad1622bdb621e68326c5c1d6

SHA1
c759b293aea7943ba4e70337de178810a7d3e376

SHA256
0845bf85eff48238b41213d61cbea8a419dc0d3895f4352da21eaed0675393be

SHA512
8d3335e933d781a2adf016208bc4debf574fd41b02eb8069f3756024eac60a4719161f5e27842da4dbe6be325f884b4747dda5552c0741a390c6e8cab176193e

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/Session Storage/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
8008e35d9151e2a3b121d1f50685735c

SHA1
79bfaeea3b58cc95c4fbeb94ec013c17f2037d33

SHA256
5d706f2d5f48dfdfa8a10651d72a454b4c7085caf62aaf34bb187031d999adfd

SHA512
eb78bffd733548b581e174f123f111d259f90bc8939a93b07f187de81252f6a3454334a35b772d561c899763ba9d423a98fa97f701a103ec7cd3dc67dfec3abb

Download Submit
/data/user/0/com.personal.pdf/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.personal.pdf/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.personal.pdf/app_webview/webview_data.lock

Filesize
22B

MD5
206323a2dbf88f3b7eb92fc1423520af

SHA1
f793ec06962b2b8756c7fcfbc9ec0372b67347b8

SHA256
dbf64a1b6fa2498e2d195dec9b5785c2585b3fd67954957a92c4c96928442e3c

SHA512
6e79462f94d814c3f88b985e82e8c051dbe4a4eecbc8b82f73533eee9d0bce553dbb65c24d053d4bdb68fc9c45c6b7d1c8503c68f2881faa2dfdb0f36a68847f

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
021f54d042baec66270fd01ac8921ffe

SHA1
446a9c71dead1e1188a6cd7bbbd5b9a76e909ab8

SHA256
5f2740d7d2b9f827322b38e73dd369c63fe58fb797624cb8988550ffbaa9c661

SHA512
b48cd7755fe8c62068991deb6472d253795e0e5c22bf980fcb366a04fbf41c3495bca325d4f09a771eb757c11a2fd7862068e5bfe9016597b415e57e239bc83e

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/44e5652fb145311f_0

Filesize
3KB

MD5
fbc2b6816f8e8b167154d9abb82d1604

SHA1
77a66202e4ca37dfebfa86e76d1339248799f78e

SHA256
dd4b7daadfc95c0850e4ec108052dae9973fc0d4a901da893d0df85b15c40283

SHA512
88369b441711939004005658fd65d6a7e15833387d1a7922947bb8fa3678a6dc419a6a8472c0439c92192ae6d4e58c7647663bf533b463a53c373a29a291f2d4

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/6f729cdd8af6b4b7_0

Filesize
1KB

MD5
21d956d296868d36437b881a9efffe1b

SHA1
1f49fddde196092a1c83bc1282f1e4304e1fdb42

SHA256
04773cfdb86891b7c875d4b90c5b72463ff261206d2bbf593a889932ac06d3eb

SHA512
28db38bde7193ce3be8d02d000c6820287a231b24d46446bd17dcc925383a3c70be0076c357e686f96552022aef85dd1468036bdfa34d11adb7cf3e610edfe6f

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
eca29ae97ca32eb61252ccb66f740347

SHA1
c530b41c66ddeb5d87f21961de548857b94e8f4d

SHA256
89bb1035a150c6b1fef2d0e30d90b07c55f1f376ecbc06ea69093b18b623c451

SHA512
21fd212286429fc987d1fcbba3773eb0142cfe143697fb818b53236ea535b34987543430948cd79e9ebef14fb02d8057ea6df8913091ca798c64b9579c8e0560

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
340faa4a096e9ba6b7da3b509af93563

SHA1
52a59a29b3d3a08314b925ed86484cfc126bb52d

SHA256
d585407e22dec822e1b49e4212a589076bcdae55cd263a3178ce10488b2dbb3a

SHA512
1fe4c00146b8683a2feba5618b41b1dff96acf8587bbc9e881ed7dd1274f2f51893bba4dad4af2bea06dda80ec8a4455daa1db9e87da885d8d4b0b28374da2c4

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
144B

MD5
d7516fcc103e8b277b164f817315800d

SHA1
159a6fe9bb1012e4635ce4c7c895e4860d8371b1

SHA256
a6070f276aa46144671e6f108b63b523533ac1111c6bbf1f74f5e4fefd4153ce

SHA512
495eb4334aa6499bf5298646aa0e5ef156e5fc066fcd3452f9e99c433076f80000764ff3256e259dc6359b88780ec968d46a85cb301b270d3dbd8a4a4b5f103d

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
192B

MD5
1334935e1eccf959fa963e8470ecf478

SHA1
ef96f9a1988d7f022e5b546a87f8ce6c211e8ab0

SHA256
51b0081d0ea5b39df84e9ed7678a0af9d56b3ec379cc0ca8a57b5da0f8840a4b

SHA512
a358d6d1feb67c2851a20f020364f2c3e292f33725ae095f47280a827a40e9c527613b652b595129dd121cb144d541ff108813020efdff928877a5201cadb160

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.personal.pdf/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit