anubis | b4bd65520d764bea63e2956f63cfe1e79109aa63efc39f3fd938e29df77cf0fd

Analysis

max time kernel
34s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
18-10-2024 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4bd65520d764bea63e2956f63cfe1e79109aa63efc39f3fd938e29df77cf0fd.apk
Size

361KB
MD5

18a3c09ce58b3db05cf248730adb6bd0
SHA1

b8df9c4fbc07539f5b25929b132d97c1416b6710
SHA256

b4bd65520d764bea63e2956f63cfe1e79109aa63efc39f3fd938e29df77cf0fd
SHA512

e883b9da7887e01f13a25eb7a3f8ca619cf1040f2b50f7790632cc58e09f833a4b76f77aa687bb1fded4ebbe8703f5106138c9acd2b21f57e76f44e84bd81ff6
SSDEEP

6144:DTomipFaxl2ZkyY47C+uGFKkOsOQwT7gTnEJD0VilSIKexXSFuauAvGh:DUmipFayvu+uqKkKQ+DliFuauAvGh

Score

10^/10

anubis banker collection credential_access discovery evasion infostealer persistence stealth trojan

Malware Config

Extracted

Family

anubis

https://qzwrxetcryvtubynumnuybtvrcewsdcfv.com

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4967	com.kcyhit.tjdedz

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar	4967	com.kcyhit.tjdedz

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kcyhit.tjdedz
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.kcyhit.tjdedz

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kcyhit.tjdedz

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.kcyhit.tjdedz

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.kcyhit.tjdedz

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.kcyhit.tjdedz

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.kcyhit.tjdedz

com.kcyhit.tjdedz
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4967

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar

Filesize
184KB

MD5
ad0b831361de0aa3ef9f15004bf8f574

SHA1
869f3107c20842e3e7897baa068731247768e6c0

SHA256
10af72e1709bece34705e9b8903d83217a645da841f5868ef1151d742c72575c

SHA512
09640c3dc9c207d977d3492540a6532de97dd00a2ecd359042922021022611fad7e96c79b5c4da5b3f55d6789a384e5ed462b37f56aec728ca86ade940b9d9bb

Download Submit
/data/user/0/com.kcyhit.tjdedz/app_files/lyqpustqpfi.jar

Filesize
370KB

MD5
8948db9613f2e38613b46632a19b9d3f

SHA1
93267c031f65423e4f590667ae2a87535938120f

SHA256
5cdc2336d5c98e5f26f16ec19d7f875e0e8fd9b05c0f91c1eaefa040790be405

SHA512
2e5c742047649a199d96055ab9e036d5de1bc062f61082536ec31562fa8b924c80725ffe3069c034417a8d3e5fff651d25b6de67581f23f4463ca5ea2c140a4c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads