Overview

overview

10

Static

static

6

8ae20794d2...d8.apk

android-9-x86

10

8ae20794d2...d8.apk

android-10-x64

10

8ae20794d2...d8.apk

android-11-x64

10

Analysis

  • max time kernel
    46s
  • max time network
    147s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    10-12-2024 13:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8ae20794d2fc7659a003d5debd6970d8.apk

  • Size

    1.9MB

  • MD5

    8ae20794d2fc7659a003d5debd6970d8

  • SHA1

    7aadc3e33871db0111a32c5b0bf68ec8db7860e5

  • SHA256

    9c7b234d0d46169dcefb9f5b22c5df134b1a120b67666c071feaf97a6078d1a1

  • SHA512

    30f1bbb28cfc2ad105e2f86302f124fa60c0fd382f245b0be829710e9fdd29d347ae8063431158445f4877b3c4062c4d664e87779f1eae50d1cc2bb37fcc646d

  • SSDEEP

    24576:K4Ztl4P4sHD4n7rcl1yZWng5BpzFTVt8AMPpaNZOo+Bm4xdG4NKBTLDfmCNCZkLJ:KIytcIkz5VDMPpq+BmwdG4GTLDfoML9h

Score
10/10
anubisbankercollectioncredential_accessdiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

anubis

C2

http://old.mandamientos.ga

Signatures

  • Anubis banker

    Android banker that uses overlays.

    bankertrojaninfostealeranubis
  • Anubis family
    anubis
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests enabling of the accessibility settings. 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests enabling of the accessibility settings.
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4250
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/oat/x86/Pa.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4276

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json
    Filesize

    1.0MB

    MD5

    cb9df5c68e588e64aec0dc13fff5d918

    SHA1

    db665796ff8b5d029bb661caf0118f5f3cb143aa

    SHA256

    d073367064a20c35f08a59adcefd7bb017e567a36b26913ce22e8f2acfd1f8fb

    SHA512

    7007874302d06c01e086e50105f941cd6b14e7916aae6071746026908ba9e486e97f51bd96279d633f7c181623600fcdff9f0efd49531b86ff0fcde225079280

    Download Submit

  • /data/data/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json
    Filesize

    1.0MB

    MD5

    8b4f731ed2aa6bfe3042e1183e83c60e

    SHA1

    a90dca5eac7130025abb00a666ca190590776c30

    SHA256

    8306aed35abe6dd4105d060a4ccb1afcb87cc97cb2444c03ebf320810706089e

    SHA512

    12db81a65b170ef03f07d9cc441f06dced2776ca0a57cc3205fcdb934814a48bd8670eabd8352ad5f27277a620fc4bae6e36986c5f9c03a346e1051ad74b58bb

    Download Submit

  • /data/data/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/oat/Pa.json.cur.prof
    Filesize

    273B

    MD5

    ba6ff0b4acbf79a6f45fd38d4067152c

    SHA1

    83ed2984e0debcc165bcb465b678883dd3711f11

    SHA256

    b50fa47bd8440d0a67633ed3708517a7582c05b2b59ae044f5442dd599b64afe

    SHA512

    fb1f379d9968870d90ce9b75c26be75da1612a9aacb868a932b7373b070d016cdd51dbdc3c7119c8e7173a7543db089b75a05e1881c3c6cd8318dbcfff7f1570

    Download Submit

  • /data/user/0/gohcthplmgmyrcnhcgsxtysyue.rqjgllnxahaafqsyplz.lcoguawmyxbdzriqeiczstw/app_DynamicOptDex/Pa.json
    Filesize

    1.0MB

    MD5

    d595d9f399b6d8f4b1a2e997d35ac357

    SHA1

    b1d3ff25a1e52472fde39e5680bdb93b3e345b9e

    SHA256

    f574a93ef6c8901fad0770a5a78e5fa2c75279ba286ab32bb0b842eb1d636f95

    SHA512

    b5ba9eb09f359e8a90cd08abcbca9411a786569f021f14f718a342e0f35dfba5b8fba8723939a70f07cd19b9d86929acaf2864bcdd452f6c7eb21c2a94b2defc

    Download Submit