anubis | eb22cda0c0e7b299d6cffe02ef3b04d7b2de7b16f27ad7b6058753c5f2723f12

Analysis

max time kernel
38s
max time network
155s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
24-01-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb22cda0c0e7b299d6cffe02ef3b04d7b2de7b16f27ad7b6058753c5f2723f12.apk
Size

457KB
MD5

be4418728de05dd953326c1380a3219c
SHA1

447586421fcb94398da3d97cd9edc17a21b75bb3
SHA256

eb22cda0c0e7b299d6cffe02ef3b04d7b2de7b16f27ad7b6058753c5f2723f12
SHA512

1f7b0442b828c7f0cd9a169ba7b053c4d1bffca148fe1bb9cf1f71389027261e5524eff0dd586c91755a466be62caef9d5de676a82165f8f736fbd43c3d54ddc
SSDEEP

12288:8kZHjTlNHRZK/NAisRNwMoiwPXAbMpLxNwMoiwPXAbMpLH:8KnHR+sjmiwPQwZmiwPQwZ

Score

10^/10

anubis banker evasion infostealer stealth trojan

Malware Config

Extracted

Family

anubis

https://fhghfghfghfghfghf

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kxflvwsmk.fuyajfsvusb
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.kxflvwsmk.fuyajfsvusb

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4964	com.kxflvwsmk.fuyajfsvusb

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.kxflvwsmk.fuyajfsvusb/app_files/fvxznwqptypd.jar	4964	com.kxflvwsmk.fuyajfsvusb

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kxflvwsmk.fuyajfsvusb

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.kxflvwsmk.fuyajfsvusb

com.kxflvwsmk.fuyajfsvusb
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.kxflvwsmk.fuyajfsvusb/app_files/fvxznwqptypd.jar

Filesize
114KB

MD5
8ac6352558a2bd2021b62e84540bf9f5

SHA1
d5891cdade2f4ac52fd9291bb257432e8f54bbbc

SHA256
47b0dd4e7c63f3feb360532df44d5cf439624527c8cc6478e58caecb43f665f9

SHA512
0c223e00f3e1d1285c90e96e689e86bf81fd7009c1812a90afdadf8bdbc92ac821516fe46997baef7fff894b9bcca1708cc2244a558d9fafebcc415944dd786b

Download Submit
/data/user/0/com.kxflvwsmk.fuyajfsvusb/app_files/fvxznwqptypd.jar

Filesize
272KB

MD5
584a03dea4437ba634469b51b22cdb0c

SHA1
1a5d70454aa09f17babe6b612bf14fff7b65be1d

SHA256
d23750e03b6adfbd08fac1285c813dc0fe71f305b3e5c6b453fb907fdb30e749

SHA512
3fa72f0bf98688b9d31028f1fbe23ffd9b0bbe708f5587766f1cf1be9ca8c5d480daeb9b23b568aed9fd7998da2e889d263c562a7e2dca716289542fb0170fc9

Download Submit