anubis | c31016c52dacd5a736cfbfd1e9fafbd29e0dec1154262aea2377b20074f86f8f

General

Target

c434692ff5c51b4fb171e9a4b6120a0f_JaffaCakes118
Size

561KB
Sample

240827-crxg9axgpd
MD5

c434692ff5c51b4fb171e9a4b6120a0f
SHA1

c7771fafc0a7c92feb897ea90e07e08266036161
SHA256

c31016c52dacd5a736cfbfd1e9fafbd29e0dec1154262aea2377b20074f86f8f
SHA512

41546501c33cb49d7259f50ccb2ef3bc1c77b115147ff7a2b8a66d29c4dc7c8b250e7852b0f12ae2f885ab09288c650269e951e05e5bfd63166613575240a9c7
SSDEEP

12288:h352MQJltd8RnLapnMphyNQFV/GK868v1M7RtZG:B5kluneJMya/GKP6Ow

Score

10^/10

Malware Config

Extracted

Family

anubis

C2

http://localhost:8080/

Targets

- Target
  
  c434692ff5c51b4fb171e9a4b6120a0f_JaffaCakes118
- Size
  
  561KB
- MD5
  
  c434692ff5c51b4fb171e9a4b6120a0f
- SHA1
  
  c7771fafc0a7c92feb897ea90e07e08266036161
- SHA256
  
  c31016c52dacd5a736cfbfd1e9fafbd29e0dec1154262aea2377b20074f86f8f
- SHA512
  
  41546501c33cb49d7259f50ccb2ef3bc1c77b115147ff7a2b8a66d29c4dc7c8b250e7852b0f12ae2f885ab09288c650269e951e05e5bfd63166613575240a9c7
- SSDEEP
  
  12288:h352MQJltd8RnLapnMphyNQFV/GK868v1M7RtZG:B5kluneJMya/GKP6Ow
Score

10^/10

anubis banker discovery infostealer trojan
- Anubis banker
  Android banker that uses overlays.
  banker trojan infostealer anubis
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Declares services with permission to bind to the system
- Requests dangerous framework permissions
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Anubis banker

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Declares services with permission to bind to the system

Requests dangerous framework permissions

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2