anubis | 814001a82cc709413ba6d301ad65bd32052e4aa493313117e50cfcb419e3d086

Analysis

max time kernel
2341378s
max time network
158s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
20/12/2023, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
814001a82cc709413ba6d301ad65bd32052e4aa493313117e50cfcb419e3d086.apk
Size 2.5MB
Sample231220-d4ba8addh7
SHA256 814001a82cc709413ba6d301ad65bd32052e4aa493313117e50cfcb419e3d086
MD5 ebb3f0c1dd02fa60eaae2a881445f903
SHA1 32608b24115e7450dd94305efdfa982e0b6ea4bb
SHA512 f01d16e2d8a0611a31692e7a30062981cc8d62229b5d21515bf1fb4a74ec01cfd7c69f5014abbfc3fdbbe29135a3286bfaf62ca74fbc8048184285a1095a2a79
SSDEEP 49152:gWBO0yQ1vpyQiyQryQaLaimVc926DGBeAFYMGPVb9syI/jWYByQqtMAXH/fhcY8B:LykpytyGyhatckS+GPVpNIlByFXXnr8B
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

anubis banker evasion infostealer stealth trojan

Malware Config

Extracted

Family

anubis

https://martilerrentcarskirolrte.com/

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4994	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json	4994	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr
/data/user/0/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json	4994	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr

pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4994

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Fg.json

Path /data/data/pimniwgttytaiztgxszckjnliss.jtscbwzuaqb.hmtmnfpdtwglmempr/app_DynamicOptDex/Fg.json
Size 1.2MB
SHA256 ae1a46741a3008bb7468330fca80669fdf8b3c5e339eecf12d1114b58f1ab594
MD5 ffb7b0eab9e8ad8e78a3381e08ba8eb2
SHA1 0da7b6813dc505c317a2bbae88c3c52eb55e9849
SHA512 b5426d9731355102de5740ed66e7777dc10b32d30164091278c3c7220fd5efaf375f07882124edb0deab7d66d6edc11e0f5e5744656fb2bc98fe5474ddeea9fa
SSDEEP 24576:HAjB+Ua8xmVAXjC4tbWBSa28D7P+L0UHCCVjdmW+wOJsIj9kuAO7n:uBaqmVAXO4tiBSOn2IUzVj7+wePPAOb
MD5 SHA1 SHA512 SSDEEP

Submit Download