Overview

overview

10

Static

static

6

b4bd65520d...fd.apk

android-10-x64

10

b4bd65520d...fd.apk

android-11-x64

10

b4bd65520d...fd.apk

android-13-x64

10

b4bd65520d...fd.apk

android-9-x86

10

Resubmissions

19/04/2024, 05:52

240419-gkytysad4610

12/04/2024, 14:00

240412-rbfbcsah9310

25/03/2024, 02:20

240325-csfwwsde6510

Analysis

  • max time kernel
    56s
  • max time network
    308s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240229-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
  • submitted
    12/04/2024, 14:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b4bd65520d764bea63e2956f63cfe1e79109aa63efc39f3fd938e29df77cf0fd.apk
  • Size 361KB
  • Sample240412-rbfbcsah93
  • SHA256 b4bd65520d764bea63e2956f63cfe1e79109aa63efc39f3fd938e29df77cf0fd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
anubisbankercollectiondiscoveryevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

  • anubis

C2

  • https://qzwrxetcryvtubynumnuybtvrcewsdcfv.com

Signatures

  • Anubis banker

    Android banker that uses overlays.

    bankertrojaninfostealeranubis
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Loads dropped Dex/Jar 1 TTPs 51 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Requests enabling of the accessibility settings. 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.kcyhit.tjdedz
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Requests enabling of the accessibility settings.
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4242

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        framework-adservices.jar
        • Path /apex/com.android.adservices/javalib/framework-adservices.jar
        • Size 25KB
        • SHA256 ebf554eca9585be7cc99314e35c844d481ab811456055a1127b3df4641cf2ffb
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-sdksandbox.jar
        • Path /apex/com.android.adservices/javalib/framework-sdksandbox.jar
        • Size 11KB
        • SHA256 e71199d47af29d61859792529bfee051ebb23b92747d57e402d6af30c8d2a9c2
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-appsearch.jar
        • Path /apex/com.android.appsearch/javalib/framework-appsearch.jar
        • Size 145KB
        • SHA256 a77cfbc9d66d3fde22540b2e6a5bee8ce21dbeb3f66c0d9121764513188252f7
        • MD5 SHA1 SHA512 SSDEEP
        Download

        apache-xml.jar
        • Path /apex/com.android.art/javalib/apache-xml.jar
        • Size 1.2MB
        • SHA256 a592316ce171525b731179a84d91a1f7824d5e7c2c6f713d038163a95f7f3626
        • MD5 SHA1 SHA512 SSDEEP
        Download

        bouncycastle.jar
        • Path /apex/com.android.art/javalib/bouncycastle.jar
        • Size 1.4MB
        • SHA256 b12a49fda7dec105cac09b6d77b083d37b1be5d52f4f265790f2e348e5783f06
        • MD5 SHA1 SHA512 SSDEEP
        Download

        core-libart.jar
        • Path /apex/com.android.art/javalib/core-libart.jar
        • Size 549KB
        • SHA256 eb3b040c7700fccdc6a637ff9628c0867b6f48ebac4b09c2b5bb4dd77baf3d38
        • MD5 SHA1 SHA512 SSDEEP
        Download

        core-oj.jar
        • Path /apex/com.android.art/javalib/core-oj.jar
        • Size 5.0MB
        • SHA256 d9d541d074d858571d60e2964fd39fb74130217fa7c92d74ed1695b0962837cf
        • MD5 SHA1 SHA512 SSDEEP
        Download

        okhttp.jar
        • Path /apex/com.android.art/javalib/okhttp.jar
        • Size 397KB
        • SHA256 14d759d0257e1be79263f4ff0bd41548af7f83f7d5f8f5029dae5e58a4687ada
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-bluetooth.jar
        • Path /apex/com.android.btservices/javalib/framework-bluetooth.jar
        • Size 937KB
        • SHA256 9f51175dca7d241cff99acba4f8e29a1b781f3d16a72baebc8ab7434ded1869c
        • MD5 SHA1 SHA512 SSDEEP
        Download

        conscrypt.jar
        • Path /apex/com.android.conscrypt/javalib/conscrypt.jar
        • Size 453KB
        • SHA256 787aa8fdbb20b5a4df8a61213c8df30de929dc610967f32712611b323d89d32d
        • MD5 SHA1 SHA512 SSDEEP
        Download

        core-icu4j.jar
        • Path /apex/com.android.i18n/javalib/core-icu4j.jar
        • Size 2.7MB
        • SHA256 baa7c3b0f8df0cb4e6b925b44ccf99dbe35dbf4be00a0ae33c5e4eeb173ce7f5
        • MD5 SHA1 SHA512 SSDEEP
        Download

        android.net.ipsec.ike.jar
        • Path /apex/com.android.ipsec/javalib/android.net.ipsec.ike.jar
        • Size 670KB
        • SHA256 dbf99fd2ecc3f0a085855d9a53881b91132da8f0e85dd11d92ee46db01d6ab83
        • MD5 SHA1 SHA512 SSDEEP
        Download

        updatable-media.jar
        • Path /apex/com.android.media/javalib/updatable-media.jar
        • Size 482KB
        • SHA256 19eb02aed8c826a9a4b74d11a345e8ecbe1fe5562c5b9d13ac1286efaa4771e9
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-mediaprovider.jar
        • Path /apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar
        • Size 73KB
        • SHA256 6ae5b642fe117238ea95d6f39931c86cc3e784115a0874e8b742dab88ef9629b
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-ondevicepersonalization.jar
        • Path /apex/com.android.ondevicepersonalization/javalib/framework-ondevicepersonalization.jar
        • Size 8KB
        • SHA256 f2d356c75b62b631972f29ed268497b3088e80676f34c4f8ea779d30be959b4f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-statsd.jar
        • Path /apex/com.android.os.statsd/javalib/framework-statsd.jar
        • Size 73KB
        • SHA256 22481f2149c6f9b6e8873c4419c8fd33fd72c7dd1ef8e968c63ba3a1c8eab914
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-permission-s.jar
        • Path /apex/com.android.permission/javalib/framework-permission-s.jar
        • Size 173KB
        • SHA256 25c24c41332b5886427c5864067ac491e163a6c729bc219b31183b229e5d3219
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-permission.jar
        • Path /apex/com.android.permission/javalib/framework-permission.jar
        • Size 612B
        • SHA256 e62333a706d04ca49f917826f49770ad089d134580f050567de912ecac31302c
        • MD5 SHA1 SHA512
        Download

        framework-scheduling.jar
        • Path /apex/com.android.scheduling/javalib/framework-scheduling.jar
        • Size 11KB
        • SHA256 a80d2a1dd96cbfd38ed68d8934611f2294ff8f85fce7378500570814d571ce7e
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-sdkextensions.jar
        • Path /apex/com.android.sdkext/javalib/framework-sdkextensions.jar
        • Size 5KB
        • SHA256 835e58ff912600ddef1b3fa9adaff5d7e2c4b379fbe8adaac065122777b204a5
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-connectivity-t.jar
        • Path /apex/com.android.tethering/javalib/framework-connectivity-t.jar
        • Size 374KB
        • SHA256 595956d19b204fce5ae88e02999467cd6bee084158ef209fce06958d76806608
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-connectivity.jar
        • Path /apex/com.android.tethering/javalib/framework-connectivity.jar
        • Size 490KB
        • SHA256 13f8f21e0f6c093ce54e81bbd0e169f605060d68a60070bffb0e1ba2e54a40c0
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-tethering.jar
        • Path /apex/com.android.tethering/javalib/framework-tethering.jar
        • Size 63KB
        • SHA256 fdabd2584172b86fb29014cb70f61e5995c229db5fe098a80244809bb7bca7cc
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-uwb.jar
        • Path /apex/com.android.uwb/javalib/framework-uwb.jar
        • Size 102KB
        • SHA256 31ec5ef294c561e6ead889767bd0656714f42998717a947427150d51dbc3b367
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-wifi.jar
        • Path /apex/com.android.wifi/javalib/framework-wifi.jar
        • Size 985KB
        • SHA256 79bb444346e1086292f96dfd8f859fe6e72fb439c1426db6915aaddb5bd30a65
        • MD5 SHA1 SHA512 SSDEEP
        Download

        lyqpustqpfi.jar
        • Path /data/user/0/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar
        • Size 184KB
        • SHA256 10af72e1709bece34705e9b8903d83217a645da841f5868ef1151d742c72575c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        lyqpustqpfi.jar
        • Path /data/user/0/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar
        • Size 370KB
        • SHA256 5cdc2336d5c98e5f26f16ec19d7f875e0e8fd9b05c0f91c1eaefa040790be405
        • MD5 SHA1 SHA512 SSDEEP
        Download