anubis | c31016c52dacd5a736cfbfd1e9fafbd29e0dec1154262aea2377b20074f86f8f

General

Target

c31016c52dacd5a736cfbfd1e9fafbd29e0dec1154262aea2377b20074f86f8f.exe
Size

561KB
MD5

c434692ff5c51b4fb171e9a4b6120a0f
SHA1

c7771fafc0a7c92feb897ea90e07e08266036161
SHA256

c31016c52dacd5a736cfbfd1e9fafbd29e0dec1154262aea2377b20074f86f8f
SHA512

41546501c33cb49d7259f50ccb2ef3bc1c77b115147ff7a2b8a66d29c4dc7c8b250e7852b0f12ae2f885ab09288c650269e951e05e5bfd63166613575240a9c7
SSDEEP

12288:h352MQJltd8RnLapnMphyNQFV/GK868v1M7RtZG:B5kluneJMya/GKP6Ow

Score

10^/10

anubis banker infostealer trojan

Malware Config

Extracted

Family

anubis

C2

http://localhost:8080/

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Executes dropped EXE 1 IoCs

pid	Process
900	7z2.exe

Loads dropped DLL 2 IoCs

pid	Process
1520	c31016c52dacd5a736cfbfd1e9fafbd29e0dec1154262aea2377b20074f86f8f.exe
948	Process not Found

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	900	7z2.exe
Token: 35	900	7z2.exe
Token: SeSecurityPrivilege	900	7z2.exe
Token: SeSecurityPrivilege	900	7z2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 900	1520	c31016c52dacd5a736cfbfd1e9fafbd29e0dec1154262aea2377b20074f86f8f.exe	28
PID 1520 wrote to memory of 900	1520	c31016c52dacd5a736cfbfd1e9fafbd29e0dec1154262aea2377b20074f86f8f.exe	28
PID 1520 wrote to memory of 900	1520	c31016c52dacd5a736cfbfd1e9fafbd29e0dec1154262aea2377b20074f86f8f.exe	28
PID 1520 wrote to memory of 900	1520	c31016c52dacd5a736cfbfd1e9fafbd29e0dec1154262aea2377b20074f86f8f.exe	28

C:\Users\Admin\AppData\Local\Temp\c31016c52dacd5a736cfbfd1e9fafbd29e0dec1154262aea2377b20074f86f8f.exe
"C:\Users\Admin\AppData\Local\Temp\c31016c52dacd5a736cfbfd1e9fafbd29e0dec1154262aea2377b20074f86f8f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\7z2.exe
  "C:\Users\Admin\AppData\Local\Temp\7z2.exe" x "C:\Users\Admin\AppData\Local\Temp\stubfile.7z" -o"C:\Users\Admin\AppData\Local\Temp\" -y
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7z2.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\stub.apk

Filesize
261KB

MD5
907e167bab28358e03413f4a32ff91f1

SHA1
b72068b03565bcb8ac2322a8d8def67c975f488f

SHA256
3c302715512ce87b98ffb0e7ecb8c8638d25c5b0462fd127bb1c638e99b37938

SHA512
003120d75bc469ed2e196946ff7ec6d002e9916f5eb35f303738934f7632ff316e1c527688d742952c17f9db143d1d73803fd1727933e1f26d8fd9ec1dad1de6

Download Submit
C:\Users\Admin\AppData\Local\Temp\stubfile.7z

Filesize
173KB

MD5
cda2a5aac4fcb466f42e311fa1082a3d

SHA1
cc9197bef10ed6b24161613bcfa41f1dd9b6e29d

SHA256
4f0945e90196e2fbeb939fb75b04969767e48f78c06920fd6962712fa3202faa

SHA512
9e4d8567a0569e7aed2058c6b972e972eabf38060005202bfb37799a18324da981e2176b9cdedb6272d3ab7db3dffd196984f93f9c711e664f164891e31e2a9f

Download Submit
\Users\Admin\AppData\Local\Temp\7z2.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
\Users\Admin\AppData\Local\Temp\7z2.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
memory/1520-54-0x0000000000F70000-0x0000000001004000-memory.dmp

Filesize
592KB

Download
memory/1520-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1520-56-0x00000000050F0000-0x0000000005194000-memory.dmp

Filesize
656KB

Download
memory/1520-63-0x0000000004C05000-0x0000000004C16000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing