Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
54s -
max time network
169s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
17/05/2024, 18:26
Static task
static1
Behavioral task
behavioral1
Sample
8ae20794d2fc7659a003d5debd6970d8.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
8ae20794d2fc7659a003d5debd6970d8.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
8ae20794d2fc7659a003d5debd6970d8.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
8ae20794d2fc7659a003d5debd6970d8.apk
-
Size
1.9MB
-
MD5
8ae20794d2fc7659a003d5debd6970d8
-
SHA1
7aadc3e33871db0111a32c5b0bf68ec8db7860e5
-
SHA256
9c7b234d0d46169dcefb9f5b22c5df134b1a120b67666c071feaf97a6078d1a1
-
SHA512
30f1bbb28cfc2ad105e2f86302f124fa60c0fd382f245b0be829710e9fdd29d347ae8063431158445f4877b3c4062c4d664e87779f1eae50d1cc2bb37fcc646d
-
SSDEEP
24576:K4Ztl4P4sHD4n7rcl1yZWng5BpzFTVt8AMPpaNZOo+Bm4xdG4NKBTLDfmCNCZkLJ:KIytcIkz5VDMPpq+BmwdG4GTLDfoML9h
Malware Config
Extracted
anubis
http://old.mandamientos.ga
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw -
pid Process 4208 gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json 4208 gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw /data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json 4235 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/oat/x86/Pa.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json 4208 gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
description ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw -
Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw
Processes
-
gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Checks if the internet connection is available
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4208 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/oat/x86/Pa.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4235
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json
Filesize1.0MB
MD5cb9df5c68e588e64aec0dc13fff5d918
SHA1db665796ff8b5d029bb661caf0118f5f3cb143aa
SHA256d073367064a20c35f08a59adcefd7bb017e567a36b26913ce22e8f2acfd1f8fb
SHA5127007874302d06c01e086e50105f941cd6b14e7916aae6071746026908ba9e486e97f51bd96279d633f7c181623600fcdff9f0efd49531b86ff0fcde225079280
-
/data/data/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json
Filesize1.0MB
MD58b4f731ed2aa6bfe3042e1183e83c60e
SHA1a90dca5eac7130025abb00a666ca190590776c30
SHA2568306aed35abe6dd4105d060a4ccb1afcb87cc97cb2444c03ebf320810706089e
SHA51212db81a65b170ef03f07d9cc441f06dced2776ca0a57cc3205fcdb934814a48bd8670eabd8352ad5f27277a620fc4bae6e36986c5f9c03a346e1051ad74b58bb
-
/data/data/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/oat/Pa.json.cur.prof
Filesize266B
MD53f3e73fb97c179fdd5fddfa718548207
SHA1b4b413e9195aba030db89a3ade3c2b1cad1ae900
SHA256e1c0747ef43e233abf698821f03726b272a3b87f512d7e77ae63186573174e9d
SHA512b303adf21d0b2a27ccc400eedbb51cabe2a57cf1849c318b59b019c94ace72f84e38fbf63a91b9633ec4a073413f9487d05741e8db059b700518ae4a17186877
-
/data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json
Filesize1.0MB
MD5d595d9f399b6d8f4b1a2e997d35ac357
SHA1b1d3ff25a1e52472fde39e5680bdb93b3e345b9e
SHA256f574a93ef6c8901fad0770a5a78e5fa2c75279ba286ab32bb0b842eb1d636f95
SHA512b5ba9eb09f359e8a90cd08abcbca9411a786569f021f14f718a342e0f35dfba5b8fba8723939a70f07cd19b9d86929acaf2864bcdd452f6c7eb21c2a94b2defc