anubis | b4bd65520d764bea63e2956f63cfe1e79109aa63efc39f3fd938e29df77cf0fd

General

Target

AndroidUpdates.apk
Size

361KB
Sample

240324-fw5wzahh97
MD5

18a3c09ce58b3db05cf248730adb6bd0
SHA1

b8df9c4fbc07539f5b25929b132d97c1416b6710
SHA256

b4bd65520d764bea63e2956f63cfe1e79109aa63efc39f3fd938e29df77cf0fd
SHA512

e883b9da7887e01f13a25eb7a3f8ca619cf1040f2b50f7790632cc58e09f833a4b76f77aa687bb1fded4ebbe8703f5106138c9acd2b21f57e76f44e84bd81ff6
SSDEEP

6144:DTomipFaxl2ZkyY47C+uGFKkOsOQwT7gTnEJD0VilSIKexXSFuauAvGh:DUmipFayvu+uqKkKQ+DliFuauAvGh

Score

10^/10

Malware Config

Extracted

Family

anubis

C2

https://qzwrxetcryvtubynumnuybtvrcewsdcfv.com

Targets

- Target
  
  AndroidUpdates.apk
- Size
  
  361KB
- MD5
  
  18a3c09ce58b3db05cf248730adb6bd0
- SHA1
  
  b8df9c4fbc07539f5b25929b132d97c1416b6710
- SHA256
  
  b4bd65520d764bea63e2956f63cfe1e79109aa63efc39f3fd938e29df77cf0fd
- SHA512
  
  e883b9da7887e01f13a25eb7a3f8ca619cf1040f2b50f7790632cc58e09f833a4b76f77aa687bb1fded4ebbe8703f5106138c9acd2b21f57e76f44e84bd81ff6
- SSDEEP
  
  6144:DTomipFaxl2ZkyY47C+uGFKkOsOQwT7gTnEJD0VilSIKexXSFuauAvGh:DUmipFayvu+uqKkKQ+DliFuauAvGh
Score

10^/10

anubis banker collection evasion infostealer persistence stealth trojan discovery
- Anubis banker
  Android banker that uses overlays.
  banker trojan infostealer anubis
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
- Listens for changes in the sensor environment (might be used to detect emulation)
  evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Anubis banker

Makes use of the framework's Accessibility service

Removes its main activity from the application launcher

Loads dropped Dex/Jar

Makes use of the framework's foreground persistence service

Requests enabling of the accessibility settings.

Acquires the wake lock

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3