anubis | a7c5e7d22e4638fd83c45791225be170c7c84f4a3fc1ab0af2c42ef6ee9b51d9[.]bin

General

Target

a7c5e7d22e4638fd83c45791225be170c7c84f4a3fc1ab0af2c42ef6ee9b51d9.bin
Size

1.5MB
MD5

611bc7da4477b3e697dc9897334675bb
SHA1

7038b40d406b4a91cbd2c6cf6e0d7ac5cd157979
SHA256

a7c5e7d22e4638fd83c45791225be170c7c84f4a3fc1ab0af2c42ef6ee9b51d9
SHA512

7b5309464525db9b3e205f12d51544e8d2d08359b4ce4a71445edae6972e2e5c8d485876e742fd50a8464b19e89ed3b225c6f63a67353620bea05378b7ed8052
SSDEEP

24576:J+WWTuBeOFGO7VQXHoGy1CQmKhAtK8lK/kF8QYnp703kkCCL4HgLn28:JDaoz/7VCHt0Ckhq2sFxYnSk/CL/n28

Score

10^/10

anubis

Malware Config

Extracted

Family

anubis

C2

http://localhost:8080/

Signatures

Anubis family
anubis

Declares broadcast receivers with permission to handle system events 1 IoCs

Processes:

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 1 IoCs

Processes:

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 45 IoCs

Processes:

description	ioc
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to send SMS messages.	android.permission.SEND_SMS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Files

a7c5e7d22e4638fd83c45791225be170c7c84f4a3fc1ab0af2c42ef6ee9b51d9.bin
.apk android

sampop.sampo.samp

sampop.sampo.samp.sampop7

Activities

sampop.sampo.samp.sampop7

android.intent.action.CHOOSER
android.intent.action.MAIN
android.intent.action.VIEW
android.intent.action.SEND
android.intent.action.SEND_MULTIPLE
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_CHANGED
com.ui.OnAlarmReceiver.ACTION_WIDGET_RECEIVER
com.android.vending.billing.InAppBillingService.COIN
com.android.vending.billing.InAppBillingService.COIO
com.android.vending.billing.InAppBillingService.LUCM
com.android.vending.billing.InAppBillingService.PROX
ir.cafebazaar.pardakht.InAppBillingService.BIND
ru.aaaaaaax.installer
com.nokia.payment.iapenabler.InAppBillingService.BIND
com.android.vending.billing.InAppBillingService.INST

wocwvy.czyxoxmbauu.slsa.opzsdswiddt

android.intent.action.SEND
android.intent.action.SENDTO

Permissions

android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
android.permission.WAKE_LOCK
android.permission.READ_CONTACTS
android.permission.READ_CALL_LOG
android.permission.ACCESS_WIFI_STATE
android.permission.GET_ACCOUNTS
android.permission.SET_WALLPAPER
android.permission.WRITE_SETTINGS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.CALL_PHONE
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_PHONE_STATE
android.permission.CALL_PHONE
android.permission.READ_SMS
android.permission.READ_CONTACTS
android.permission.READ_CALL_LOG
android.permission.SEND_SMS
com.android.browser.permission.READ_HISTORY_BOOKMARKS
android.permission.CAMERA
com.android.browser.permission.WRITE_HISTORY_BOOKMARKS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.PROCESS_OUTGOING_CALLS
android.permission.STORAGE
android.permission.RECORD_AUDIO
android.permission.FLASHLIGHT
android.permission.CAMERA
android.permission.BLUETOOTH
android.permission.READ_EXTERNAL_STORAGE
com.android.browser.permission.READ_HISTORY_BOOKMARKS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.SET_WALLPAPER
android.permission.SET_WALLPAPER_HINTS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.VIBRATE
android.permission.CAMERA
android.permission.GET_ACCOUNTS
android.permission.WAKE_LOCK
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_CONTACTS
android.permission.RECORD_AUDIO
android.permission.READ_SMS
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.READ_CALL_LOG
android.permission.INTERNET
android.permission.READ_PHONE_STATE
android.permission.CALL_PHONE
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.RECEIVE_SMS
android.permission.GET_TASKS
android.permission.PROCESS_OUTGOING_CALLS
android.permission.BROADCAST_PACKAGE_ADDED
android.permission.BROADCAST_PACKAGE_CHANGED
android.permission.BROADCAST_PACKAGE_INSTALL
android.permission.BROADCAST_PACKAGE_REPLACED
com.sec.android.provider.badge.permission.READ
com.sec.android.provider.badge.permission.WRITE
com.htc.launcher.permission.READ_SETTINGS
com.htc.launcher.permission.UPDATE_SHORTCUT
com.sonyericsson.home.permission.BROADCAST_BADGE
com.sonymobile.home.permission.PROVIDER_INSERT_BADGE
com.anddoes.launcher.permission.UPDATE_COUNT
com.majeur.launcher.permission.UPDATE_BADGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.huawei.android.launcher.permission.READ_SETTINGS
com.huawei.android.launcher.permission.WRITE_SETTINGS
android.permission.READ_APP_BADGE
com.oppo.launcher.permission.READ_SETTINGS
com.oppo.launcher.permission.WRITE_SETTINGS
me.everything.badger.permission.BADGE_COUNT_READ
me.everything.badger.permission.BADGE_COUNT_WRITE
android.permission.ACCESS_FINE_LOCATION
android.permission.GET_TASKS
android.permission.RECEIVE_SMS
android.permission.READ_SMS
android.permission.WRITE_SMS
android.permission.PACKAGE_USAGE_STATS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.ACCESS_NETWORK_STATE
android.permission.CALL_PHONE
android.permission.INTERNET
android.permission.SEND_SMS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.RECORD_AUDIO
android.permission.READ_CONTACTS
android.permission.READ_PHONE_STATE
android.permission.WAKE_LOCK
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

Receivers

wocwvy.czyxoxmbauu.slsa.pworotsvjdlioho.cmtstflxlxb

android.provider.Telephony.SMS_DELIVER

wocwvy.czyxoxmbauu.slsa.pworotsvjdlioho.qpgopfninoaazln

android.provider.Telephony.WAP_PUSH_DELIVER

wocwvy.czyxoxmbauu.slsa.pworotsvjdlioho.hypihteeavv

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
com.htc.intent.action.QUICKBOOT_POWERON
android.intent.action.USER_PRESENT
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.provider.Telephony.SMS_RECEIVED
android.intent.action.SCREEN_ON
android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE
android.net.conn.CONNECTIVITY_CHANGE
android.net.conn.CONNECTIVITY_CHANGE
android.net.wifi.WIFI_STATE_CHANGED
android.intent.action.DREAMING_STOPPED

sampop.sampo.samp.sampop10

android.provider.Telephony.SMS_RECEIVED

sampop.sampo.samp.sampop9

android.intent.action.PHONE_STATE
android.intent.action.NEW_OUTGOING_CALL

sampop.sampo.samp.sampop12

android.intent.action.BOOT_COMPLETED

sampop.sampo.samp.sampop4

android.intent.action.BOOT_COMPLETED

sampop.sampo.samp.sampop2

android.app.action.DEVICE_ADMIN_ENABLED
android.app.action.DEVICE_ADMIN_DISABLE_REQUESTED
android.app.action.DEVICE_ADMIN_DISABLED

sampop.sampo.samp.sampop3

android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_CHANGED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_INSTALL

sampop.sampo.samp.sampop8

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

sampop.sampo.samp.sampop18

android.permission.READ_PHONE_STATE
android.intent.action.NEW_OUTGOING_CALL
android.intent.action.PHONE_STATE

Services

wocwvy.czyxoxmbauu.slsa.lmimy

android.intent.action.RESPOND_VIA_MESSAGE

wocwvy.czyxoxmbauu.slsa.egxltnv

android.accessibilityservice.AccessibilityService

Android Permissions

a7c5e7d22e4638fd83c45791225be170c7c84f4a3fc1ab0af2c42ef6ee9b51d9.bin

Permissions

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.WAKE_LOCK

android.permission.READ_CONTACTS

android.permission.READ_CALL_LOG

android.permission.ACCESS_WIFI_STATE

android.permission.GET_ACCOUNTS

android.permission.SET_WALLPAPER

android.permission.WRITE_SETTINGS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.CALL_PHONE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_PHONE_STATE

android.permission.CALL_PHONE

android.permission.READ_SMS

android.permission.READ_CONTACTS

android.permission.READ_CALL_LOG

android.permission.SEND_SMS

com.android.browser.permission.READ_HISTORY_BOOKMARKS

android.permission.CAMERA

com.android.browser.permission.WRITE_HISTORY_BOOKMARKS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.PROCESS_OUTGOING_CALLS

android.permission.STORAGE

android.permission.RECORD_AUDIO

android.permission.FLASHLIGHT

android.permission.CAMERA

android.permission.BLUETOOTH

android.permission.READ_EXTERNAL_STORAGE

com.android.browser.permission.READ_HISTORY_BOOKMARKS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.SET_WALLPAPER

android.permission.SET_WALLPAPER_HINTS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.VIBRATE

android.permission.CAMERA

android.permission.GET_ACCOUNTS

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_CONTACTS

android.permission.RECORD_AUDIO

android.permission.READ_SMS

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.READ_CALL_LOG

Sharing

General

Malware Config

Extracted

Signatures

Files

sampop.sampo.samp

sampop.sampo.samp.sampop7

Activities

sampop.sampo.samp.sampop7

wocwvy.czyxoxmbauu.slsa.opzsdswiddt

Permissions

Receivers

wocwvy.czyxoxmbauu.slsa.pworotsvjdlioho.cmtstflxlxb

wocwvy.czyxoxmbauu.slsa.pworotsvjdlioho.qpgopfninoaazln

wocwvy.czyxoxmbauu.slsa.pworotsvjdlioho.hypihteeavv

sampop.sampo.samp.sampop10

sampop.sampo.samp.sampop9

sampop.sampo.samp.sampop12

sampop.sampo.samp.sampop4

sampop.sampo.samp.sampop2

sampop.sampo.samp.sampop3

sampop.sampo.samp.sampop8

sampop.sampo.samp.sampop18

Services

wocwvy.czyxoxmbauu.slsa.lmimy

wocwvy.czyxoxmbauu.slsa.egxltnv

Android Permissions

a7c5e7d22e4638fd83c45791225be170c7c84f4a3fc1ab0af2c42ef6ee9b51d9.bin