anubis | a7c5e7d22e4638fd83c45791225be170c7c84f4a3fc1ab0af2c42ef6ee9b51d9

General

Target

a7c5e7d22e4638fd83c45791225be170c7c84f4a3fc1ab0af2c42ef6ee9b51d9.bin
Size

1.5MB
Sample

240707-1y4f5s1eme
MD5

611bc7da4477b3e697dc9897334675bb
SHA1

7038b40d406b4a91cbd2c6cf6e0d7ac5cd157979
SHA256

a7c5e7d22e4638fd83c45791225be170c7c84f4a3fc1ab0af2c42ef6ee9b51d9
SHA512

7b5309464525db9b3e205f12d51544e8d2d08359b4ce4a71445edae6972e2e5c8d485876e742fd50a8464b19e89ed3b225c6f63a67353620bea05378b7ed8052
SSDEEP

24576:J+WWTuBeOFGO7VQXHoGy1CQmKhAtK8lK/kF8QYnp703kkCCL4HgLn28:JDaoz/7VCHt0Ckhq2sFxYnSk/CL/n28

Score

10^/10

Malware Config

Extracted

Family

anubis

C2

http://localhost:8080/

Targets

- Target
  
  a7c5e7d22e4638fd83c45791225be170c7c84f4a3fc1ab0af2c42ef6ee9b51d9.bin
- Size
  
  1.5MB
- MD5
  
  611bc7da4477b3e697dc9897334675bb
- SHA1
  
  7038b40d406b4a91cbd2c6cf6e0d7ac5cd157979
- SHA256
  
  a7c5e7d22e4638fd83c45791225be170c7c84f4a3fc1ab0af2c42ef6ee9b51d9
- SHA512
  
  7b5309464525db9b3e205f12d51544e8d2d08359b4ce4a71445edae6972e2e5c8d485876e742fd50a8464b19e89ed3b225c6f63a67353620bea05378b7ed8052
- SSDEEP
  
  24576:J+WWTuBeOFGO7VQXHoGy1CQmKhAtK8lK/kF8QYnp703kkCCL4HgLn28:JDaoz/7VCHt0Ckhq2sFxYnSk/CL/n28
Score

8^/10

banker collection credential_access discovery evasion impact persistence stealth trojan
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
- Requests enabling of the accessibility settings.
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Removes its main activity from the application launcher

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries the phone number (MSISDN for GSM devices)

Acquires the wake lock

Makes use of the framework's foreground persistence service

Queries information about active data network

Queries the mobile country code (MCC)

Reads information about phone network operator.

Requests enabling of the accessibility settings.

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3