Analysis
-
max time kernel
55s -
max time network
182s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
24-08-2024 22:01
Static task
static1
Behavioral task
behavioral1
Sample
bc019f3a99d9ae74a11a687b22becdf392a591c7e9d942bc9986a89c8734074c.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
bc019f3a99d9ae74a11a687b22becdf392a591c7e9d942bc9986a89c8734074c.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
bc019f3a99d9ae74a11a687b22becdf392a591c7e9d942bc9986a89c8734074c.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
bc019f3a99d9ae74a11a687b22becdf392a591c7e9d942bc9986a89c8734074c.apk
-
Size
4.3MB
-
MD5
777e967cc20e6a3cd7ed8f6534f25e68
-
SHA1
e41f2f8b87c38865b60aed52c7c1fa6131cc153a
-
SHA256
bc019f3a99d9ae74a11a687b22becdf392a591c7e9d942bc9986a89c8734074c
-
SHA512
dbc66a87f31df000970881b4c7d457ba8763ad0a2112b3262a7d212b00dbccf197bc69acd8e5decb9cffb4b99a1bd8d8ae21cbc9dc4b89b0443227cc6b6f0d2f
-
SSDEEP
98304:awEsJsucv+SyogYG93PLwfPHdmRqccbLt/i/o3aF+rG7O5:aCmV+vogY03UfPHdmjcb5iQ3lx5
Malware Config
Extracted
anubis
https://google.com
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Processes:
com.tencent.mmpid process 4677 com.tencent.mm 4677 com.tencent.mm 4677 com.tencent.mm -
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.tencent.mmioc pid process /data/user/0/com.tencent.mm/app_mph_dex/classes.dex 4677 com.tencent.mm /data/user/0/com.tencent.mm/app_mph_dex/classes.dex 4677 com.tencent.mm /data/user/0/com.tencent.mm/app_mph_dex/classes.dex (deleted) 4677 com.tencent.mm /data/user/0/com.tencent.mm/app_mph_dex/classes.dex (deleted) 4677 com.tencent.mm -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.tencent.mmdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.tencent.mm Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.tencent.mm Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.tencent.mm -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
Processes:
com.tencent.mmdescription ioc process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.tencent.mm -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
Processes:
com.tencent.mmdescription ioc process URI accessed for read content://com.android.contacts/data/phones com.tencent.mm -
Reads the content of the calendar entry data. 1 TTPs 1 IoCs
Processes:
com.tencent.mmdescription ioc process URI accessed for read content://com.android.calendar/events com.tencent.mm -
Reads the content of the call log. 1 TTPs 1 IoCs
Processes:
com.tencent.mmdescription ioc process URI accessed for read content://call_log/calls com.tencent.mm -
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
com.tencent.mmdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.tencent.mm -
Acquires the wake lock 1 IoCs
Processes:
com.tencent.mmdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.tencent.mm -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.tencent.mmdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.tencent.mm -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.tencent.mmdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.tencent.mm -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.tencent.mmdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.tencent.mm -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.tencent.mmdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.tencent.mm -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
com.tencent.mmdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.tencent.mm -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes:
com.tencent.mmdescription ioc process Framework API call android.hardware.SensorManager.registerListener com.tencent.mm -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
com.tencent.mmdescription ioc process Framework service call android.app.job.IJobScheduler.schedule com.tencent.mm
Processes
-
com.tencent.mm1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the calendar entry data.
- Reads the content of the call log.
- Requests cell location
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Schedules tasks to execute at a specified time
PID:4677
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Foreground Persistence
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Input Injection
1Discovery
Location Tracking
1Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.8MB
MD54abd076b62015297ab751dfc75c9789a
SHA192ec5965cb57693a80731f948e12f465340fd6ad
SHA2564202d90128f1e82c8181ab70876e3159295037e62d16a0b572d2b635a8a6a8f4
SHA512022889c959eb62e5ac7ffb2147d120357e39241e3a101c2e49912a9a5870fc2b2a121340fd3e2ed2a885fd5fc4dd7e7cc85df2e53f5109c24427d0a6edd9d05f
-
Filesize
32KB
MD51854505a3f6d683ed7eb81612934370c
SHA14f710add9a652d2fb92b7ce45589e27bf03f0b2a
SHA2568100330a266f3027b929ea1bde99440ce4a544c9d9a0abb2ef0d1a73aa4cd9a4
SHA512104a6e9c840b1fddd22ae579624a549c911abfbb48dc4454d3d231619c41a9abbf22f0dc5362a80c8c8245cc18566661f3645ac48c61259132886d4bf4678962
-
Filesize
512B
MD5052ed23bc1eea2d71138bafb9603b36c
SHA153c83ea5344779f1ce9aa13666bf89f09c5cf6e2
SHA2563a20c3c8d76c911a1ed7e5454de808e7174228ded01fd68dc51393910f7edce3
SHA512575145f17f3e9eedb391183e39e7e0278e77730bc3cb8225a9a84270fd9ad5e460fe64169aea1d5b31cf1799548023af2e0109244055d70c8ce0beea627ae40d
-
Filesize
8KB
MD5ca92e378ad2056b04888f21551b3fff1
SHA1f1329fb81f8b58c38b8c80c99cca1676cdb7322d
SHA25658640625caacbfd7ee3f0f55b706cb0da1e008d903ba228864b2d1b4f92c96cb
SHA512164125621f73c0c970fa550ad82d0b489ff938a93fbd1f5b060249764045c4f77c4a54db237cf1e35db93fcca670de2069ab458ea73e3c7394c70282fdcce99e
-
Filesize
8KB
MD50baccd1c3f5448b5e402b13e04cb6593
SHA18ec486d5339d2859648f5076646eea75ad4a4048
SHA2564d64ff528c92804b4832514fa24fa4067048659ee0ee8e6f5745c730c5fe4434
SHA512fe152cea66cc0698a6f20f8697d0a28dfd80e0bd09bf17bd222048c1bf83b2d660351d18d039ddfba057b3f0aee69ccac3fa7b4391561113ec11aea97f0ab52f
-
Filesize
8KB
MD51bde3b74e0e074d2145791518bb4b7b7
SHA1d4bb332f3c77d1ede2a9cf3ab799587bb86af326
SHA256636977298419f297e262d57b130d4bfa9ddf63303a8ff7f351d964ed10bc293d
SHA5125d3384ad0969f93ad1db4e11d60ec74b762395614ada4d01e6a8789c16bd56e2a4a5ab50a372ff7e3c27018569bf7cd1c36e7b25b81932e645e29a3dbe2a1ddb
-
Filesize
8KB
MD5ac6873057a2162ac43b2c3a4fa85f9d3
SHA19fac6a67df0eafbc3fdac45e2105fd2c45553ed4
SHA256cfbaa225c0adf14001ec3cdd06b40c210aa19aaee437c8418dcc46e96b7f139f
SHA512859a8f81489b1c88ba2bf1e3bf523bec708a5a3ddd015ae7cc2bceb195c333eac21ccaf1e89db484c04b4104812609b2fcd628438668edfdd66dfc60894df36e
-
Filesize
16KB
MD56b43c76510d4f242414e0c58672a9904
SHA1119321c29afa5fefaf5a9bd9f6fad8a880b482c6
SHA256b63c2a1d15fe115d3c04436ee18db656931db16a7792a6fe8baada3da1b7cb05
SHA512f40256081748dae8aa43751886d35e4b38b87244c7954152980bcce8dedf1fafc2cc030313c41a37b7571b154e79adfad9b96945399d9152f3f9e36e13d8ea2e
-
Filesize
8KB
MD5a25ddd5fcb6edddfd30de2443d8079d9
SHA11ea9d4d387b9194289db797774c40f476f43a662
SHA2567a4d545d89414493e3e20fc9c3566c3c6b27a9066b6c27965fdbf3d07669eb9e
SHA5124c55067920ecdc739eaa5ecc41cf4aace0238c6dcad853e1c03f4438f297361a23e684e42418de6cc5a5e3dfa0f8de3af7ea3a74400d0c9d6fd7bd19a26a5bc0
-
Filesize
8KB
MD5b440c53b8acc24d092aaea1e232a2e3e
SHA1383c11e7be388d347be47b0420267a10f6890566
SHA2563155d52484858775fe95b11db1e42e684bc7beabeacadc0a83f0131e03be0c40
SHA5123219360f23e745165a3e135cc47e6fdde633b9eb3c9a0e1e0ce2eef4b04b3b5f2d99d9d8176940abf59d8299f3eed0cf9802c48df116844ccc9a7193f5a8dd36
-
Filesize
512B
MD562c8a367e626d14f46d2bc916434a476
SHA1138cd1537f2e542cb7eed485d4ae9f20147ecc76
SHA2566854954448179a0baa816d65ddb3a18b19490a59b060b820262e327d98e9026f
SHA512d7b44ff979e8ec0288bd41623694ece5f714920f964e6bee8aedbd01f204a3805ad35687dfb263a0d612f93a987e7d8349f3dc3de21755806333559f70dae8a4
-
Filesize
8KB
MD5ad000b208892ee3d9f0d98cd9ae31caa
SHA1d4c4b4f149bac687e9957f72222fb40444a92f5a
SHA256d58285bdf9c86eab361b62a520003a0ec04d99e2602701adc0caf4405f3fc56b
SHA5125d1c34fcada2f8a586e1947639152ab874e597572d9b7b770c8b4fea6c0317c21d8ff5eafaf37952b579b3e5c4b7401dcce9b9b93677219a87e5df10cd5fe70c
-
Filesize
8KB
MD50a2d6343ee69a741c86ec66660da60cd
SHA14d3a47f41be4d2507cf227d464ae870473aabe17
SHA256429d949620141d5c8c41452dc2eed2c81ab4c137b399ecc47f914ee0a37eb90e
SHA512500757b28298c173e34e7bc39cf37e4ad1b67c7a135565e36196f0613f0e1f648332d5d93f64e87341a961c6a58afa1d7463b2c9dcd0ff22dd33f324b82170ea
-
Filesize
8KB
MD5586261222995267ed5f2643f76417af8
SHA12aeeb4324b32d525451acd3f288bbec022aea559
SHA256d04b01ff34b6672e4360212e754cfc229012305e68ea6e4773b9c25f0fdb5adc
SHA512c0dfb55549f2b4a6e48e7ec51f6c2da8b27931d10102248f9212a8c11a1a80f408b9b93c0c31bf607b71cbd5614c7d8f86b9b32d0c4e2b15dbbe5fa0b9a57873
-
Filesize
3B
MD558e0494c51d30eb3494f7c9198986bb9
SHA1cd0d4cc32346750408f7d4f5e78ec9a6e5b79a0d
SHA25637517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570
SHA512b7a9336ed3a424b5d4d59d9b20d0bbc33217207b584db6b758fddb9a70b99e7c8c9f8387ef318a6b2039e62f09a3a2592bf5c76d6947a6ea1d107b924d7461f4
-
Filesize
108B
MD5289f0dc449560596ef392d75009bd9d3
SHA14f4acdc8bbc0e292599040f641cb3abcb4e8ee29
SHA256ef16187824743461839f6bec5a2044062c92ec7b3d5ae11cfbefd80eeeefb49e
SHA5124856e0da91baaf5e24beedf92c79b9a618f59d854d7a2ca901b33363388740eb8aedac5db7a1abc8943b169886eac809a9ada6eb429b68dcc5bd5fe86e66e20d
-
Filesize
108B
MD51c4364372536cc3fe067a3d513e274a1
SHA1af8851b2a8de3606bd392243b0f652f1152d4e5d
SHA256815b7f63535268f5194479b9793bfa507b70d3d4982c05342f1e4ddb62b8e3fe
SHA5127fd3aabe2c09ab0265327b648f53668ab41798b8ab5cf2f4dff406a96aaf68d2f545d56a7212b10ef10ebe41acb4b1a384e6fb4f5edd66e32c44729511daa0b6
-
Filesize
114B
MD5375b04dc56aad89565a97a93ea660f90
SHA19ec280ddd42302ac92d0a36977e18cd84ea05d53
SHA256e860fe94d4d4de5fd072816672c95e841cc5c2662c4c22047d1c6cc19aa5f488
SHA512a61d049d860ad8c04a95bd392498753e4b00f9b4366378ea91e25fcb0e5d60ff8e4c417a920da6290d9a92f103ca7dc32951105668a783e7d0da788f5ed0a851
-
Filesize
566B
MD55ef376a43c077d20745f983d3c28dca7
SHA12a0a5e7f175be8bceb58d085572937fe9a360dbf
SHA256419139aa48dd51b9fcefd044c277e3424f19da36d2424988515ebe86c5e6f519
SHA5121e036fb56d658113b3dd8a4b971a9b0da501a0b3bc4712a28951bd64b8b9c58331d305cfce3042b1ba355df66d1f20a5d06657283f9bdc3c4015b03985f92175
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
854B
MD56a10cdb613b9e350b141a0e2f0f29d10
SHA10a41d070f962fea142580af9f5b5ca8effbdaaa7
SHA256e66248800a24fc0afb3bfa97770002ce2f6f4e24f879ab7e84e006ee7c6b8e55
SHA5128e05fe06102a251a51df13df411e22c6e363019245092257f5143b6015b9fba30a7623b25cad714bf01beddba0cd6a6b81301874617efc8de4bd01e2b0cedeb6
-
Filesize
854B
MD54539b65846230cc272e740aee1bf1d5b
SHA188040d7e9c423c4dd05a5bda3b13fe781b5e7f33
SHA256f40a5495f1ff5887c768329294f0dd6824e37f35a5bb48ce9871debe09aa9f6f
SHA51204823e2d5ab2c7c3026a3eb8591756f4fda29c7d3e9ebd334b18eb721748a9a7f3bb36c6fc944b6fb6491e91dc85c00ec48f215f5504a2a10fad84597f95bc6f
-
Filesize
10KB
MD5df036b93426f886d1696210079b94938
SHA1b593b3806d3d85257511959992013f6a4f543011
SHA2566d9bb455edd9154e310a777aad0dde552ff995134e2321933a0365f9112c3912
SHA5120d7eb6c0e5378a362a4bbebbc09f291080975c8ece8473d28c9cc9ec5b4a138f2fe19b09bc5d44cf17ec66a4f59dadb1de59ac8286cdc10a461e46491da01e29
-
Filesize
12B
MD5e48057c3603c907cacbe1568a7dbfc41
SHA16e100086b53e20e499a9be069aa1b452faf82ba3
SHA2564b36685dbf772b2de007f4c98f824966f4f3a132075692d3d3d8f11e84e5468e
SHA512787e1140832e8c308039f0287ee801c00040544d5241425b0c0c8e8dc19ecf3feefa50706723f7a21be209c13b24ab3dbe0691ec42118fdfe18611b13155fb9a
-
Filesize
267B
MD5ca83936d0c0ffdb4a991046e32ccc956
SHA16d34827e6fd5b8f716cc5f7d7843b581713aeab3
SHA256b50da55ec1fcb8d0589b49d5b3dfef915d77f3dbb24416bb1305441f81c507d2
SHA51261bb1d4d033b0ddfa7ae802d5732c00af6db3aa5bcfbda0c60a0f12bd9fbbbd03123990c55d5abbd3d6e967471101b82e409f1620a73a3cf8c627452f61440d4
-
Filesize
12B
MD5a9256f55737b655c8cff95418411997c
SHA1d81a4e85ecef3a4f08d50da9c75c49a3c64ffe24
SHA256bad705c44807d12463fb587087c4e9eb24769d82981229ac8b74abc9b1a44412
SHA51210d10a6498973ed65d47c74ba6d8831dad94213a5071353dc445de46e021689284fbbf4accf5ba1f97a0675a7652ec069ac70f38d63ba36b8595a8caf8d37574