anubis | ea0ea8d61d7e8a6aef90f1d21ed65d31c3e49ca235cecee322c9dfe631414c58

Analysis

max time kernel
15s
max time network
162s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
18-07-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea0ea8d61d7e8a6aef90f1d21ed65d31c3e49ca235cecee322c9dfe631414c58.apk
Size

360KB
MD5

dab95b4692de509ae9bea045b6ab81f1
SHA1

86356346dc2ce1f26dbb3b471cedb96b404f6e1e
SHA256

ea0ea8d61d7e8a6aef90f1d21ed65d31c3e49ca235cecee322c9dfe631414c58
SHA512

394d3f7b6f5620acd149fa6d7fef9351d94fa2521f89c35131e279d9e9f1d7d5c1918a81f4f43c66c48be55b740c6bcb40f2861e1b69fdd85585baf6e6e0827f
SSDEEP

6144:tTomipFaxl2ZkyY47C+uA7asOQwT7gTnEJD0VilSIKexXSFuauAvS40X:tUmipFayvu+uA72Q+DliFuauAvSlX

Score

10^/10

anubis banker collection credential_access evasion infostealer persistence stealth trojan

Malware Config

Extracted

Family

anubis

https://qzwrxetcryvtubynumnuybtvrcewsdcfv.com

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4966	com.kcyhit.tjdedz

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar	4966	com.kcyhit.tjdedz

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kcyhit.tjdedz

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kcyhit.tjdedz

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.kcyhit.tjdedz

com.kcyhit.tjdedz
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
PID:4966

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar

Filesize
184KB

MD5
ad0b831361de0aa3ef9f15004bf8f574

SHA1
869f3107c20842e3e7897baa068731247768e6c0

SHA256
10af72e1709bece34705e9b8903d83217a645da841f5868ef1151d742c72575c

SHA512
09640c3dc9c207d977d3492540a6532de97dd00a2ecd359042922021022611fad7e96c79b5c4da5b3f55d6789a384e5ed462b37f56aec728ca86ade940b9d9bb

Download Submit
/data/user/0/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar

Filesize
370KB

MD5
8948db9613f2e38613b46632a19b9d3f

SHA1
93267c031f65423e4f590667ae2a87535938120f

SHA256
5cdc2336d5c98e5f26f16ec19d7f875e0e8fd9b05c0f91c1eaefa040790be405

SHA512
2e5c742047649a199d96055ab9e036d5de1bc062f61082536ec31562fa8b924c80725ffe3069c034417a8d3e5fff651d25b6de67581f23f4463ca5ea2c140a4c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads