Analysis
-
max time kernel
179s -
max time network
187s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
06-08-2024 22:09
Static task
static1
Behavioral task
behavioral1
Sample
5a5dc0af9f9312675e6274234a2b9e63b84230b6f0038a18fd236b48ef1fb63a.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
5a5dc0af9f9312675e6274234a2b9e63b84230b6f0038a18fd236b48ef1fb63a.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
5a5dc0af9f9312675e6274234a2b9e63b84230b6f0038a18fd236b48ef1fb63a.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
5a5dc0af9f9312675e6274234a2b9e63b84230b6f0038a18fd236b48ef1fb63a.apk
-
Size
4.3MB
-
MD5
3a5fe8094209f0245c108b22bdc355c7
-
SHA1
5f173c587bf3b9dc31718237e0b20a653bc605a7
-
SHA256
5a5dc0af9f9312675e6274234a2b9e63b84230b6f0038a18fd236b48ef1fb63a
-
SHA512
9d8c75f3ae44dd9c2f321114285aa9691aca237a71a43aa5c02ae7e1f0caaf2b9b9f7c592042e1b8e61b40b1fcabf9ec4ac354fc97a8e75b399a8a0bc43af86d
-
SSDEEP
98304:J1EXdbqc96480w72bD2mrUxDELEz9lR9FLNBRhfrG7J:J8+261f9SUxcEt9FLNBz+
Malware Config
Extracted
anubis
https://google.com
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Processes:
com.tencent.mmpid process 4508 com.tencent.mm 4508 com.tencent.mm -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.tencent.mmioc pid process /data/user/0/com.tencent.mm/app_mph_dex/classes.dex 4508 com.tencent.mm /data/user/0/com.tencent.mm/app_mph_dex/classes.dex 4508 com.tencent.mm -
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.tencent.mmdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.tencent.mm -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
Processes:
com.tencent.mmdescription ioc process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.tencent.mm -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
Processes:
com.tencent.mmdescription ioc process URI accessed for read content://com.android.contacts/data/phones com.tencent.mm -
Reads the content of the calendar entry data. 1 TTPs 1 IoCs
Processes:
com.tencent.mmdescription ioc process URI accessed for read content://com.android.calendar/events com.tencent.mm -
Reads the content of the call log. 1 TTPs 1 IoCs
Processes:
com.tencent.mmdescription ioc process URI accessed for read content://call_log/calls com.tencent.mm -
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
com.tencent.mmdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.tencent.mm -
Acquires the wake lock 1 IoCs
Processes:
com.tencent.mmdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.tencent.mm -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.tencent.mmdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.tencent.mm -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.tencent.mmdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.tencent.mm -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.tencent.mmdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.tencent.mm -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.tencent.mmdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.tencent.mm -
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
com.tencent.mmdescription ioc process Framework service call android.app.job.IJobScheduler.schedule com.tencent.mm
Processes
-
com.tencent.mm1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the calendar entry data.
- Reads the content of the call log.
- Requests cell location
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
PID:4508
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Discovery
Location Tracking
1Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3System Network Connections Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.8MB
MD5f8139cd0fe2c145552a513fb07bc0fca
SHA1c59a997f9f3551ec1e24fa804a12e64f032a66a2
SHA25633faf000c66badfd5f98cc26e49589b7d2908754c0c9bd48ac2bf6b5818831a7
SHA512face134d5f12f101b4cdb5ef9b37750aebc17fd619c48aa220b10cb6987fe187f6e60d1489effafbb37257b16737be3c41bf2417e9bc64b23aa0802395a13e39
-
Filesize
32KB
MD51854505a3f6d683ed7eb81612934370c
SHA14f710add9a652d2fb92b7ce45589e27bf03f0b2a
SHA2568100330a266f3027b929ea1bde99440ce4a544c9d9a0abb2ef0d1a73aa4cd9a4
SHA512104a6e9c840b1fddd22ae579624a549c911abfbb48dc4454d3d231619c41a9abbf22f0dc5362a80c8c8245cc18566661f3645ac48c61259132886d4bf4678962
-
Filesize
512B
MD58aa2f05d977718fa502242ef61322737
SHA19af1cdbd327531c810d9533c2c65d111f8666ad7
SHA256d8acd036be70219e7c7a86f02a32b7b77a6e78ddb2c9d899d1fc18ab5b4d24c2
SHA512fc90c007d1e0366a252961b07f249d9b5066517443301cf751438671d38b261f6c03e588fa9ad4a72e51d15dc5b8e60d9796bf41e8d5656a583e0e5873ed5e2c
-
Filesize
8KB
MD5d50f6f62cd67136fd1b1b43c02dfc918
SHA1e35ac7acda083f0dbfd469e3b91fb48e59300de4
SHA256ed7deb64a51b36bbbbb2d06951a4f409541d48f566295651df427721460384a4
SHA512a8d89b4c10372adfd05c1bd5b9cbcbbb3c98fe1cfbad86c5da5c47adb3b4f93912a8a823b630dc476e31e008d5416c8456a73ab76bbfdb6586913ab34d25832c
-
Filesize
8KB
MD5e09180f8b3d0e8e8240013a17116f82a
SHA1dae60246cfc867be02393754c34e2722adf0c108
SHA25690c24fd492a56414f2a077abf102756ab00f025636d04dd5c395c8522e6b3ae3
SHA51285763e38db14929acd541257f7ad281e059c4f6e62b17fd51e57ff58b0c8fc9b11b0702da18aca19eb5fc7c19d5cea532ac945e34523c56903040e05a2a789e6
-
Filesize
8KB
MD59387ce44feb4f5054843348b467d6ed5
SHA12e2aba0477d83d5eb5179571c4546da7ec2da481
SHA256bc8ff331f376e6a6d2735471493d39159021eac65c33e66849c592699f36fc12
SHA512f36448d2ae87582a73a4adcbf994c6f45bc76de74524cb0be7aad19c437be66c1ccd69d847980ff429cb887ec0c79aea7160a432a0e24294a5a6bddbc3d4b55e
-
Filesize
8KB
MD596161b5fa256ab47158252d50ea34f02
SHA1c7913abab4fe787536157d4c12be48a426cf3a01
SHA2560e3e5fb41cfee6270952c9dd49646bec5f552573aaf2ab9617288b23358db904
SHA5125d2d85436c259cf4564c890c218c763135301f5da075d9953824a7162ac67f28eb7481668317373ae69fa04387346a83696f0286e756e6254421aa42ab794535
-
Filesize
16KB
MD5ef18dac1e844188804e516d31b4496b0
SHA1094f1f532a3b591fd4a5295eb891c28c45b143c1
SHA2564e6f926f9e9a31256b6b14b0a7d2c698559e353d383ecd108600bcd4d0de5119
SHA51285f5a7d84546bd2dd18f9f3f32d2d13c5be2e4496d0f365052486e8ac4cdca2c547df31e2a7f313763ae491fcac99bfa5f9b02cc5b57147b79a40cf0381e0f63
-
Filesize
8KB
MD5ffe18465370522b19b38d36ec6303d3b
SHA10c0c319c3fe65625025c318607326efb1080a3ef
SHA256bd033a6d4808d08bc9bc6aeada35f95e2819162164bfeaf3529ec1a7e7e489b4
SHA512d79ab8b56fdf318b2f9c95e944bb2a7efcf753a83534a8b373620038b42351ad4a7726094b0a66b6ffc212dab9a6a0702e934b9dfdc4c2802d2cd209347dee51
-
Filesize
8KB
MD57c8cd6c86feaccb8aa81f5ca324d4337
SHA1a3f40b8ada9d1c16e4f51175f4654aed1b59ef45
SHA256a5b60c2cf526b4966d6195de7c4e15b61afbf1a38d8d82367dd224032e044157
SHA5129ae281d87d9a8db3168892dcda000aa2e6d17f0f546ccb06dcc208aa2209ca6975dfa190684c3b1190276bcd201794023b56c3bef5a8f1b0ea3647498f63d120
-
Filesize
512B
MD51abb8910e94528858cfb761151934bc2
SHA140f7de4cc33adaed736291eba4540f7876180850
SHA256d6db0244773db5ed3071aaa065184966b5c6779656a324b9349f335a194315bf
SHA51271b52ac98884424ebed9ee1b36bcfe824c92bf3614f053c238f8b4dc41ec92b5762aaf4d3ec67928b824ba0da59cba9da5c5d5bcb6a2e46324b4960892dc95a5
-
Filesize
8KB
MD54635b21aed254487610f39923726b6f1
SHA1d558f8271b911da18b886b1d2dff73c980b398be
SHA25671a5f423a565e9de2f9261dd0290d948980cf51062ac628bd18126ba55e42dc4
SHA5127bfdb7996c6d7c032c5a518297aab61099ea75e9142e7de1a835f62c6c939be1153fb0eab4ffc9ecf5a5311d33b4cd733aab95441fa2f369f4dd4df09d7746d9
-
Filesize
8KB
MD5f3bb2d6f2b85e1dc2f588b2cb4b4660a
SHA1c2c35d939875ff6c7a1a41415269a022eae34285
SHA2562f85ba18f39f6cc30291a6ca15365750024da46d364710dbb4ddf7066d93397c
SHA51261d9ed69db65d7bc79014b2848448a1eebc42701055aea8124ae3cc4d826cdc9cf6674bca4f133379aefdcc3c535b47483bc76c6ab61945d00e9e07360ec79fe
-
Filesize
8KB
MD5bf1ad06e7b7ee80931ca9dd8e20dc934
SHA1e4d07725e2e294b14c1dd11a7ef3eacdea2bc206
SHA256a170062cf751a190b60d8b06c970382f937eb66213e298295e0b4c5da389efee
SHA5124ef7fe5d9d6dc3437ec72913ebccca68664507b4362e627e71eec2168f3893f852d79ed0f5745e91a4a34db486e77f5a895679c57a25891d9273b43b8cb1cca2
-
Filesize
3B
MD558e0494c51d30eb3494f7c9198986bb9
SHA1cd0d4cc32346750408f7d4f5e78ec9a6e5b79a0d
SHA25637517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570
SHA512b7a9336ed3a424b5d4d59d9b20d0bbc33217207b584db6b758fddb9a70b99e7c8c9f8387ef318a6b2039e62f09a3a2592bf5c76d6947a6ea1d107b924d7461f4
-
Filesize
108B
MD50dd2b508096bd5c9a1d8d3bc6b9299bd
SHA1304483a10a95a5c78fb792255d192f6bc5b0e4cd
SHA2560ac4ebfe55505fabb69c61517ee19aa03c4dd106755e89e0d98d5c195a760fec
SHA51269bd317ae8c07779b4cf9660ddcb4b8d7bcaf9def3c908a4730162c490d1aef6b0643bf5ba4e000a4414eb635c64bb838744307ef64674e1c1d53159c42ffc10
-
Filesize
108B
MD51936835b08137872f71b6a16ada8f72a
SHA1dea2104c8039ff3cb7f6650bf76d0770eca7e7c4
SHA256bde551ce1b023e52bd8bad7e8dcde923a39740e57d35c28be6b5f2bdacf28e4c
SHA512cb16861f0898235d8604248544fb5004384bf016f14db2a592290069ec6c90956eaff89babb2caca8e35a2fa94d2a1eb4050f2253ba3c6d6dd7cf3a394a2f12f
-
Filesize
114B
MD5bc7e7117015a9586a7cdeeeb726c7ef0
SHA16e3ccc1c7a07b7530bd3bfccf2c69e6f856106d3
SHA2561ab2feac460b72ac123318b430a73b69f7a33788419138c5ffa7a197d8a244eb
SHA5123496e9b2e0677d77d73a692c0b0b99788e1c8a80f043ba5b5bdb19d678d872cb060b8568239c73b8c84e501746a9a6e2e83277a51f81bd4230deab458fc79e57
-
Filesize
108B
MD511e25ed20b6b726bde428d3355164c32
SHA13b0e34b6576d036a9ff9ebe380039851447c7a26
SHA256c9fca9d1b78b6c6e801972c5c400870db240701477c313ccd06f8cef4c16bc6e
SHA512958035a0df7a98e18b909216e4d98f194d8c30686bd2216f8227baa087aeb2dbdb9958d853a03a4b1683e75dc83053ed1973b2e4962d74668b03ad1e23537e91
-
Filesize
114B
MD525fae719490a9014ac36b65af1217749
SHA1ff6aeaf02a38fdb548e14f63cc990fb790b6260b
SHA2568586ce64aa6f5e822a858fdbfc66a9326856301e8014afbf62d993bf31d6fb42
SHA512c5bdead46237d13b5b88856884d1f9faaf81768737f67e3490ec302b5769eb6f6526d2bf9b57e90877271147b9993b4b6780a898e2fb50f97a7e009b5f504566
-
Filesize
114B
MD5ff7e682dc5de109dd2eb9ed412f2fe68
SHA162aebffc542f5900dbce11c2678afa37fcdfb240
SHA256b5f20fc596b8bf30f3d9b9a770ed863feb7f81e46822696fdd0aac859765290d
SHA5129ba1ec3cd49665b22caa5938a0f46c82b24508be66f888ce4de09a226bae7fb58c9ce086c47555ea9328d908342ab1fb0b870ba2f6a8a08fd1b6e4b5a1700f73
-
Filesize
566B
MD5e0b8ce99c08a6bd9892766a7b285f9b8
SHA1a396b9c4f5858329187b200cbf3b7d2ed494b51b
SHA25678398859251a3b3e28fa6224f716d39c2ae4ba66166c99c56d5632846aabef2a
SHA512897b8acd4aeecf58dbd9d1357a85500c7fcce8ab494dd1d80ab72bd77577e9af0ed63549d6fbca6d511da935b7f646d019ba8a364156d56f8b54cd361c973b97
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
854B
MD58866e6ee42b1b49600874c015c7e0e75
SHA1792dd0c515ff004c2479fc64c96b13660f586e77
SHA2569d97b02b3f090c13c2ff4e46bf3ea0d8a1a9fe97e6fda180b9e7bccb3186d8e8
SHA512b9c9516341d5730a875ae48c7a4b994dafc22451998df8082f80fec8e208e43dea337c85226b08a0af4c9d969ef39d2d9115a275ad397f291824f61d216534dd
-
Filesize
854B
MD5afb920b162cb30a3a326ba1814e21847
SHA19da6ae5bf799b35c0521ad13493793489d113c6a
SHA256336b70268e7e358ae2a5f54cdd952f4305f735cd755860e76603b6160eb0ad0f
SHA5120493143381af0d151296e29958adb5d4d75868c1be3d66185e3087b3ead6d0bd83816a1d05cfae43addc739a132e5b44849df132eb97e35e463788c7367bd126
-
Filesize
10KB
MD5df036b93426f886d1696210079b94938
SHA1b593b3806d3d85257511959992013f6a4f543011
SHA2566d9bb455edd9154e310a777aad0dde552ff995134e2321933a0365f9112c3912
SHA5120d7eb6c0e5378a362a4bbebbc09f291080975c8ece8473d28c9cc9ec5b4a138f2fe19b09bc5d44cf17ec66a4f59dadb1de59ac8286cdc10a461e46491da01e29
-
Filesize
12B
MD5e48057c3603c907cacbe1568a7dbfc41
SHA16e100086b53e20e499a9be069aa1b452faf82ba3
SHA2564b36685dbf772b2de007f4c98f824966f4f3a132075692d3d3d8f11e84e5468e
SHA512787e1140832e8c308039f0287ee801c00040544d5241425b0c0c8e8dc19ecf3feefa50706723f7a21be209c13b24ab3dbe0691ec42118fdfe18611b13155fb9a
-
Filesize
56B
MD55875f4fe2a4b68e19f5f6e071fd6fc6b
SHA1fe1a887f8ef6066bc30970ee9c48e0846865b9b1
SHA2564d36c3e00ee88cecd60d502af8fe1caf72cd0ca0cac7b4c61e88c78439c66377
SHA512eaec72ffcfe83f33b0522bcba628c25495711812c940c8dc97b8a1b2f406478acfd1d0dd67ec6ad46511350a48816e1a7362e535e75d946c836c0e97f87bc19f
-
Filesize
12B
MD5a9256f55737b655c8cff95418411997c
SHA1d81a4e85ecef3a4f08d50da9c75c49a3c64ffe24
SHA256bad705c44807d12463fb587087c4e9eb24769d82981229ac8b74abc9b1a44412
SHA51210d10a6498973ed65d47c74ba6d8831dad94213a5071353dc445de46e021689284fbbf4accf5ba1f97a0675a7652ec069ac70f38d63ba36b8595a8caf8d37574