anubis | eb22cda0c0e7b299d6cffe02ef3b04d7b2de7b16f27ad7b6058753c5f2723f12

Analysis

max time kernel
44s
max time network
131s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
24-01-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb22cda0c0e7b299d6cffe02ef3b04d7b2de7b16f27ad7b6058753c5f2723f12.apk
Size

457KB
MD5

be4418728de05dd953326c1380a3219c
SHA1

447586421fcb94398da3d97cd9edc17a21b75bb3
SHA256

eb22cda0c0e7b299d6cffe02ef3b04d7b2de7b16f27ad7b6058753c5f2723f12
SHA512

1f7b0442b828c7f0cd9a169ba7b053c4d1bffca148fe1bb9cf1f71389027261e5524eff0dd586c91755a466be62caef9d5de676a82165f8f736fbd43c3d54ddc
SSDEEP

12288:8kZHjTlNHRZK/NAisRNwMoiwPXAbMpLxNwMoiwPXAbMpLH:8KnHR+sjmiwPQwZmiwPQwZ

Score

10^/10

anubis banker evasion infostealer stealth trojan

Malware Config

Extracted

Family

anubis

https://fhghfghfghfghfghf

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kxflvwsmk.fuyajfsvusb
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.kxflvwsmk.fuyajfsvusb

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4483	com.kxflvwsmk.fuyajfsvusb

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.kxflvwsmk.fuyajfsvusb/app_files/fvxznwqptypd.jar	4535	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kxflvwsmk.fuyajfsvusb/app_files/fvxznwqptypd.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.kxflvwsmk.fuyajfsvusb/app_files/oat/x86/fvxznwqptypd.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.kxflvwsmk.fuyajfsvusb/app_files/fvxznwqptypd.jar	4483	com.kxflvwsmk.fuyajfsvusb

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.kxflvwsmk.fuyajfsvusb

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kxflvwsmk.fuyajfsvusb

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.kxflvwsmk.fuyajfsvusb

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.kxflvwsmk.fuyajfsvusb

com.kxflvwsmk.fuyajfsvusb
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4483
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kxflvwsmk.fuyajfsvusb/app_files/fvxznwqptypd.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.kxflvwsmk.fuyajfsvusb/app_files/oat/x86/fvxznwqptypd.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4535

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.kxflvwsmk.fuyajfsvusb/app_files/fvxznwqptypd.jar

Filesize
114KB

MD5
8ac6352558a2bd2021b62e84540bf9f5

SHA1
d5891cdade2f4ac52fd9291bb257432e8f54bbbc

SHA256
47b0dd4e7c63f3feb360532df44d5cf439624527c8cc6478e58caecb43f665f9

SHA512
0c223e00f3e1d1285c90e96e689e86bf81fd7009c1812a90afdadf8bdbc92ac821516fe46997baef7fff894b9bcca1708cc2244a558d9fafebcc415944dd786b

Download Submit
/data/user/0/com.kxflvwsmk.fuyajfsvusb/app_files/fvxznwqptypd.jar

Filesize
272KB

MD5
770e9890e99deeecd534dd0c1873d720

SHA1
3b2c1cbc70522e880abab76d24157a670deb9040

SHA256
d163b6d1bc42879e3e4552c33b83450d816aa642d7ecc4f6117d4ff309126672

SHA512
0475c5b0a8f6821728f904e0e13fc7c506b12f0e4585a88277dfa0a37b94f70d9a733dd7c97fc4daf3b728deb80af30a4924079231a036070d5f1f84dea54e03

Download Submit
/data/user/0/com.kxflvwsmk.fuyajfsvusb/app_files/fvxznwqptypd.jar

Filesize
272KB

MD5
584a03dea4437ba634469b51b22cdb0c

SHA1
1a5d70454aa09f17babe6b612bf14fff7b65be1d

SHA256
d23750e03b6adfbd08fac1285c813dc0fe71f305b3e5c6b453fb907fdb30e749

SHA512
3fa72f0bf98688b9d31028f1fbe23ffd9b0bbe708f5587766f1cf1be9ca8c5d480daeb9b23b568aed9fd7998da2e889d263c562a7e2dca716289542fb0170fc9

Download Submit