anubis | ea0ea8d61d7e8a6aef90f1d21ed65d31c3e49ca235cecee322c9dfe631414c58

General

Target

ea0ea8d61d7e8a6aef90f1d21ed65d31c3e49ca235cecee322c9dfe631414c58.apk
Size

360KB
MD5

dab95b4692de509ae9bea045b6ab81f1
SHA1

86356346dc2ce1f26dbb3b471cedb96b404f6e1e
SHA256

ea0ea8d61d7e8a6aef90f1d21ed65d31c3e49ca235cecee322c9dfe631414c58
SHA512

394d3f7b6f5620acd149fa6d7fef9351d94fa2521f89c35131e279d9e9f1d7d5c1918a81f4f43c66c48be55b740c6bcb40f2861e1b69fdd85585baf6e6e0827f
SSDEEP

6144:tTomipFaxl2ZkyY47C+uA7asOQwT7gTnEJD0VilSIKexXSFuauAvS40X:tUmipFayvu+uA72Q+DliFuauAvSlX

Score

10^/10

anubis banker collection credential_access evasion infostealer persistence stealth trojan

Malware Config

Extracted

Family

anubis

C2

https://qzwrxetcryvtubynumnuybtvrcewsdcfv.com

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4254	com.kcyhit.tjdedz

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar	4281	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.kcyhit.tjdedz/app_files/oat/x86/lyqpustqpfi.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar	4254	com.kcyhit.tjdedz

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kcyhit.tjdedz

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kcyhit.tjdedz

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.kcyhit.tjdedz

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.kcyhit.tjdedz

com.kcyhit.tjdedz
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
PID:4254
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.kcyhit.tjdedz/app_files/oat/x86/lyqpustqpfi.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4281

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

1

T1541

Hide Artifacts

1

T1628

Suppress Application Icon

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar

Filesize
184KB

MD5
ad0b831361de0aa3ef9f15004bf8f574

SHA1
869f3107c20842e3e7897baa068731247768e6c0

SHA256
10af72e1709bece34705e9b8903d83217a645da841f5868ef1151d742c72575c

SHA512
09640c3dc9c207d977d3492540a6532de97dd00a2ecd359042922021022611fad7e96c79b5c4da5b3f55d6789a384e5ed462b37f56aec728ca86ade940b9d9bb

Download Submit
/data/user/0/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar

Filesize
370KB

MD5
cfb34194807f3ffb4894f21fed9fe8df

SHA1
85ccd76d3f90dc37ef1d6a12a592725b9c08a3b8

SHA256
dc79fe835fcf87b7549ac799521287001ffcccab4719dbd924591ee40ac40e3a

SHA512
a750ee8b8f04cacf61158ce76ac47d49deab7fd8c5c99758dff8d99bef62a4955f534a1c4b3629d24358404a810a1cd77690b1c496c69c1d973177c4234a6a45

Download Submit
/data/user/0/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar

Filesize
370KB

MD5
8948db9613f2e38613b46632a19b9d3f

SHA1
93267c031f65423e4f590667ae2a87535938120f

SHA256
5cdc2336d5c98e5f26f16ec19d7f875e0e8fd9b05c0f91c1eaefa040790be405

SHA512
2e5c742047649a199d96055ab9e036d5de1bc062f61082536ec31562fa8b924c80725ffe3069c034417a8d3e5fff651d25b6de67581f23f4463ca5ea2c140a4c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads