Analysis
-
max time kernel
14s -
max time network
150s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
26-09-2024 20:57
General
-
Target
f929ff8daa83c3a7e1b88a0fdc3ca02f_JaffaCakes118.apk
-
Size
332KB
-
MD5
f929ff8daa83c3a7e1b88a0fdc3ca02f
-
SHA1
28d45decd671580e0857779e66fa0dd9cb10879d
-
SHA256
0e15a3789e1a755e9727014f9462317a56a009329f78e3a628bafce077521504
-
SHA512
ba278adc725754842bf3de4a12c2e07195e3b830fc136bc7acf7bc1539ce505d6abc506859eb75640c635be3448058727bc1a8d3c0f831663f4fb50d5669b989
-
SSDEEP
6144:3zjDL18o0bHqzSxAHY5nZv7N7YmW2HgZWUmSZv7N7YmW2HgZWUm7:fd8odSxAHyvJY92AcMvJY92Ac7
Malware Config
Extracted
anubis
http://slowtescil0.com
Signatures
-
Anubis banker
Android banker that uses overlays.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.nvsdctdzstq.qsvnhxcvex1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
110KB
MD5b0fa30054f2df95a0eb1168b42132795
SHA11ae43cce2ef57e83d3dbb7ce9a81112c2e21b0fd
SHA2561aba810916525c21cf4143c34bf448dabe5bebbc5436d2a9d7bae38e14e3cc9b
SHA512bc956e2e70a7f3ff5166cff2e1ea1183a7b13369c8d4e97746fc9de831bbf296c0e2c26725f581837ed72b44f1f7e23fd0962a0a5f8bd912a6cae857ef59dc63
-
Filesize
260KB
MD5507088d6d59be16d5aa604b4ed361e93
SHA11acf1abff5f2e28510eceea3f568ec9d3966671d
SHA256c7858e5b8f562c7ad3357ec4b7cdbf87387c94f1dfdcea8c9c4dc27b9f9ca78a
SHA51234f833f18bd70b120b9158301f11052accf1bc0eeeb94ee292756833f58cdea6bebce1aaeb13185eb621887a632d7637e0aa87d20f6fd22a5e627d6048a93606