deb9844db7bad12419f8e17251676d9995c3d30c5f1d021c343742b4b150090e

Analysis

max time kernel
40s
max time network
154s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
04/06/2024, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
945fe4c7efecb5bea5ef274af640cfd4_JaffaCakes118.apk
Size 309KB
Sample240604-lrlv7acd5t
SHA256 deb9844db7bad12419f8e17251676d9995c3d30c5f1d021c343742b4b150090e
MD5 945fe4c7efecb5bea5ef274af640cfd4
SHA1 b882e5f03052e5d5e39aa8843b300d7c1bbd5e13
SHA512 ef1db08d5d9791502deb8ba6c7a4a7de446ad987cd930254663aa49aa22744380016a86c41bb9265acc646a5dd0d98ad3d99da461ab235a37168698fae24b8f4
SSDEEP 6144:gIpkpwKSqAMpL+37w8kUeV2zaCSqTMKGF5EnjeDBAnAmeU5gg7Qh9:gIpkChqNL+3Etb1WTBGFjqnhjz7QD
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion execution persistence stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	anubis.bot.myapplication
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	anubis.bot.myapplication

Prevents application removal 1 TTPs 1 IoCs

Application may abuse the framework's APIs to prevent removal.

evasion

Prevent Application Removal

T1629.001

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	anubis.bot.myapplication

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5072	anubis.bot.myapplication

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	anubis.bot.myapplication

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	anubis.bot.myapplication

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	anubis.bot.myapplication

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	anubis.bot.myapplication

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	anubis.bot.myapplication

anubis.bot.myapplication
1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Schedules tasks to execute at a specified time
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:5072