Analysis
-
max time kernel
4247386s -
max time network
49s -
platform
android_x86 -
resource
android-x86-arm-20230621-en -
resource tags
-
submitted
27-06-2023 14:01
General
-
Target
fcbd91047f1166e7cb77840fcab9a938b5e347373fa1e079939b75c10c5a6437.apk
-
Size
469KB
-
MD5
7a239827a787779ff2b5caa36e2db2de
-
SHA1
b7827b7929a7bdef9e9297a00676e5fd795246c6
-
SHA256
fcbd91047f1166e7cb77840fcab9a938b5e347373fa1e079939b75c10c5a6437
-
SHA512
1c8af1c4c5b3c7f9f3e0f0fc88708f9fb20339c4c6ae9d559f00e4f6add604ff75312bd7f8e778bb6dc2add2dd7e481c8ece3dfa8e4f67593a0a6b882525a386
-
SSDEEP
12288:k8IMCtII8jT3BZZImBZZIaBZZIVBZZIMBZZIq:F1MWjZIEZIYZIZZImZIq
Score
10/10
Malware Config
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Renames multiple (450) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Acquires the wake lock. 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
wocwvy.czyxoxmbauu.slsa1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).