Overview

overview

10

Static

static

6

591dbaf5a3...d1.apk

android-9-x86

10

591dbaf5a3...d1.apk

android-10-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    17-12-2024 14:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    591dbaf5a32736acb502fe6a554ac6d1.apk

  • Size

    4.6MB

  • MD5

    591dbaf5a32736acb502fe6a554ac6d1

  • SHA1

    15f4870f5c6868f03376078b3ea6098570fa5da1

  • SHA256

    9e959b268a3b527a0b6b7ea7fc2009d0f025b40365d297d3128bff0c2034e61a

  • SHA512

    ccc753b7426454adec1fcb1ddd3b0746aa301716867d9b33db2ca4b14b01134b9736ba0a1525f9c007886ce8d4484d219f51ab02e2ca70e5bba0d35695f705ee

  • SSDEEP

    98304:9cLjFd76qLgcqujgbCmfA0ONiVlASXIB671nCl4wWZJn/lWGJy+:0v7XtpjTmfAFmlA7m1nClde/lWz+

Score
10/10
anubisbankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

anubis

C2

https://google.com

Signatures

  • Anubis banker

    Android banker that uses overlays.

    bankertrojaninfostealeranubis
  • Anubis family
    anubis
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 6 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Reads the content of the calendar entry data. 1 TTPs 1 IoCs
    collection
  • Reads the content of the call log. 1 TTPs 1 IoCs
    collection
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • com.tencent.mm
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries account information for other applications stored on the device
    • Reads the contacts stored on the device.
    • Reads the content of the calendar entry data.
    • Reads the content of the call log.
    • Requests cell location
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:4253
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/files/arm/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/files/arm/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4278
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/files/arm/classes2.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/files/arm/oat/x86/classes2.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4308

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Execution Guardrails

1
T1627

Geofencing

1
T1627.001

Foreground Persistence

1
T1541

Hide Artifacts

3
T1628

Suppress Application Icon

1
T1628.001

User Evasion

2
T1628.002

Input Injection

1
T1516

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Location Tracking

1
T1430

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Connections Discovery

2
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Location Tracking

1
T1430

Protected User Data

3
T1636

Calendar Entries

1
T1636.001

Call Log

1
T1636.002

Contact List

1
T1636.003

Screen Capture

1
T1513

Stored Application Data

1
T1409

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mm/databases/Dname-journal
    Filesize

    512B

    MD5

    1f6cbe64833d376c959c502a2dff5605

    SHA1

    da7badae9c99270ff2ef2a94739e2f11f7fa0823

    SHA256

    28a2f643985c8bc9c13daffd7f086cd73061e75105c82dd99e65845b31d9183c

    SHA512

    619211c2ebf6e0287584c02e78b70f1d77b2b0d661be48888143e7b6a867b178615fe44edb6b518854ec5f6bbe816b4e3bfdb52193846a50c69f3d54df1e1a3a

    Download Submit

  • /data/data/com.tencent.mm/databases/Dname-wal
    Filesize

    60KB

    MD5

    1f5e3403ae7c2ef1be9bf0ad4972deb2

    SHA1

    26a766cde2af220607c7945524c2f24472d4ee2d

    SHA256

    eef5bd9bd4b1a8cf111a79380e3c9b80215b0c2c51242dffffac2543b1aa28d1

    SHA512

    9aefb98103e4e7285656b9ead51c87cfdcff3d269ec685013666058a70f074db847edf03e528ec7edc9b9e3d990a46958da52dcc678aaa84e1fc83b2947e97b8

    Download Submit

  • /data/data/com.tencent.mm/databases/evernote_jobs.db
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.tencent.mm/databases/evernote_jobs.db-journal
    Filesize

    512B

    MD5

    229fa31ff2f14f9004248200902596a7

    SHA1

    fa0f534c2990610f48f51782642d27649e0bd1c5

    SHA256

    ac7036a6fcc7ab41b869073fc0306a56c4302ecb641fd492eec475749a2d04a3

    SHA512

    3cd38d37f9d561c584f1ab3e0025eb3a1e4d41cd03f7cc93c50d8c8541006c568f2dcd0c1cf8415760c5cc17d28f7f25730a5aefea2168577125dbb7e3ae9cdb

    Download Submit

  • /data/data/com.tencent.mm/databases/evernote_jobs.db-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.tencent.mm/databases/evernote_jobs.db-wal
    Filesize

    52KB

    MD5

    aa035a110396012898c7fdbe6804c03b

    SHA1

    fccab152fb01156558b1061b2fd819eb541e3eee

    SHA256

    5bd3303e4903e1e5b4af66af976b39c60374de849c89de196105fd53d9ab4551

    SHA512

    0250fd3f5a6f3085b7ff3e2b5414d084df306fc99c402f00c286817c73312579d224ef5b8013dd4e0031a74d21c4a7889949a38872b2714b41ebf6e1381e7ea7

    Download Submit

  • /data/data/com.tencent.mm/files/CallLogs.txt
    Filesize

    3B

    MD5

    58e0494c51d30eb3494f7c9198986bb9

    SHA1

    cd0d4cc32346750408f7d4f5e78ec9a6e5b79a0d

    SHA256

    37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570

    SHA512

    b7a9336ed3a424b5d4d59d9b20d0bbc33217207b584db6b758fddb9a70b99e7c8c9f8387ef318a6b2039e62f09a3a2592bf5c76d6947a6ea1d107b924d7461f4

    Download Submit

  • /data/data/com.tencent.mm/files/GP.txt
    Filesize

    116B

    MD5

    2b3fb7df132c8f96d975bcaca3720532

    SHA1

    244267cf5feff41032765b8cc3ed9c7acb1231c8

    SHA256

    c265df727afd84db83e9806d393193cf00e4c0f2041264764493979f669d0716

    SHA512

    fe24d57d95877b9257536bb85bc078325c340165c177e992aa9ab0cec59d8e1293e662576cd5bc9f4f4ac3e71a991bd8f6d22aada9a3498817e20462cff39882

    Download Submit

  • /data/data/com.tencent.mm/files/GP.txt
    Filesize

    126B

    MD5

    34fa3254e3763393e488fa00d4b75862

    SHA1

    2cd306117bc286be8378ce2dce2c505c3364436a

    SHA256

    7a34f7ec15538e89ab82824ed04293849c9af9ade05c2cadf36322211c6e5501

    SHA512

    351d0afacb485a48fce149020a9f02253dcf8e1c48536895ea42a0d08482b643744d57748267d133844dd28c2c7cab826855e70af72b3a2273b23654d4fa8274

    Download Submit

  • /data/data/com.tencent.mm/files/GP.txt
    Filesize

    116B

    MD5

    1579b489e83054049fb888dffd932031

    SHA1

    3d5da9faccf68fc270e62aaf2736bedce3a9d22e

    SHA256

    49dc602c503c71713ec7b0357aa5f896808c096f92d4b6dcb2656ada9494aee6

    SHA512

    e48280d9946fbb32cf515776811a5c3ab82a483f36c11702bbde153812c2850f51e6909563dea8db6ea6ff95fc0f2c3c9c842ab3df7de456aa9af9ec171e24f4

    Download Submit

  • /data/data/com.tencent.mm/files/GP.txt
    Filesize

    126B

    MD5

    eb2cb79cb3f9ef52950a82f345c2bdba

    SHA1

    08328beb3c2ddab8da8c64620606aa81d9ce5ba7

    SHA256

    06dcf35bc1ca4f1488302226b98504ee8d2b545b80cd71d75bd6c87f1e6f086e

    SHA512

    61066546a7abba44f7684a6596eb59109338274d9c2fae01e6424ebfe2487903db94164d9920ce6fb879ac424189c2b1822db9bbe6dda4810118b2e5f18e921c

    Download Submit

  • /data/data/com.tencent.mm/files/Tree.txt
    Filesize

    192B

    MD5

    91bd52f4107d5d9b8e6d7f0a588f3fe3

    SHA1

    684b3d3baaff81b943f13e88f34d617dc68a115a

    SHA256

    cbe172d250080ac727c64125e09e7f18f6325a84eac24803d008d86d76b84781

    SHA512

    26af7c7a7565a7220ec8fa21961ca6926df83540c9adef710c3dafbe85b2cc4aea8842cb613b7947aecfa696e102cfc7a235b5b50cb4e440eafd15464808e3c9

    Download Submit

  • /data/data/com.tencent.mm/files/Tree.txt
    Filesize

    281B

    MD5

    05e5c1dcba7dbb92f81ec7b3a46b278f

    SHA1

    be4ff90e7abe7e1d5e0345e5a0e5d27163077a0a

    SHA256

    7b792de0a77a58c684b220dccd39a098bcf4560ceced8393d50cd1912e5dca76

    SHA512

    ce8d0ab2c9e5e44fcfc8349439a4718573210166582721f6f9434bc623b0457dfd8bde0496055a495de14f1bc68c3fdb731fbf6147caaa356ee7fb3027789547

    Download Submit

  • /data/data/com.tencent.mm/files/accounts.txt
    Filesize

    2B

    MD5

    d751713988987e9331980363e24189ce

    SHA1

    97d170e1550eee4afc0af065b78cda302a97674c

    SHA256

    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

    SHA512

    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

    Download Submit

  • /data/data/com.tencent.mm/files/arm/classes.dex
    Filesize

    4.0MB

    MD5

    f549ee64871697a369a473ef5673d3de

    SHA1

    ff3b52841b34b603943f03282011901145aa7610

    SHA256

    d1afc8c2f139a22d735ecea2ca1f4838bfe8fb291df7c9fc02d656c6594b0de7

    SHA512

    3525841d8ed56170c3b983492569795ba0863a09d09947d28b2fde4b3e011c7c52a3a6f7cf3c3fc7f61b9cf1638dfbaa2cd9d6244503d55498dbe23e1698993d

    Download Submit

  • /data/data/com.tencent.mm/files/arm/classes2.dex
    Filesize

    7.0MB

    MD5

    dcb839b260728ede93282e30af0d4bb1

    SHA1

    bd43c36a8f428834ba015b9ecd196c57a5392c2e

    SHA256

    d3a7a28c6fd1e21dcf0b77e851a0e5ba55ab50231907e914f2c9ba081a5f49f8

    SHA512

    aa13b235f1c989db2821fab9d8821213840592dea86bb30e7ab6f534353fb6e4934fa44ee82938a5ed1a143ee0a1fec57dffc0cff53f00e37831bb225981b813

    Download Submit

  • /data/data/com.tencent.mm/files/netinfo.txt
    Filesize

    609B

    MD5

    9579baf2053f3a6bf8549d7186a71504

    SHA1

    67750cce67fe4e9159ba6c6620927434fc40046e

    SHA256

    dd11576e9ea4873725e4a69e52390f2d1e591e5642925572adbe74e6e69bb4de

    SHA512

    17119932624beeff8a24d99b5d0f12301074b5a55c8672918eeac82e2b81eaad80d6986c739ba49122f07187394e0cba776cb61d47965cd164b30fe72956f6cf

    Download Submit

  • /data/data/com.tencent.mm/files/netinfo.txt
    Filesize

    609B

    MD5

    f313e01a347543d5d2eac85f4fb6d1e9

    SHA1

    d9945e9957f08bc9b123b73ad7ea4c149292eeae

    SHA256

    caf012d69abfc95f6484659a22c4746f0a09c1cf3c62e50683ab193694b12b2c

    SHA512

    994475ad6c1ff61392dadf5fece7b6192e79ec13f6ddcf09f6dcc191899ab49d751b16828e860a96b73f5681a0944719dc0bd51d32385b465af13126dcd27390

    Download Submit

  • /data/data/com.tencent.mm/files/pkinfo.txt
    Filesize

    5KB

    MD5

    7299f2b0fc6250ee58c1a01da6b44b04

    SHA1

    63f75823b3e8ea0889953ca7659db34e61b9840f

    SHA256

    7ae7fa7cad239d55fdc33ad0b42e614e9022d54c836394b72cb486ae8d912c61

    SHA512

    e8c93c6028e6e57f7186fb9f4dd29f78bb63def1157f415266f12ebd67e474e9b9be7d4e296f7de274155516fc409adb63e9a8ebd97a8f6e27c55740504c8f51

    Download Submit

  • /data/user/0/com.tencent.mm/files/arm/classes.dex
    Filesize

    4.0MB

    MD5

    a076aef5861c5c544cee4f8c76e8bca4

    SHA1

    5894c1bb59da0dc71f425417b71382172647c61f

    SHA256

    8105dc3ecfd3b7955de75dd1644680b2277836a3abed394d457882bb812db4fe

    SHA512

    d9f70da27489df94d8f93e3714f95eea860d43e1a2e9d4e3d34c3469271140cdc08b7879e654f316c9e108d6853243922bce3abbafd926b3680dd02c75027c83

    Download Submit

  • /data/user/0/com.tencent.mm/files/arm/classes2.dex
    Filesize

    7.0MB

    MD5

    7b6a3bdfd23ee19e530936c49cb6dd93

    SHA1

    5514ab431898f776fc495f320d146c9e39b6abf4

    SHA256

    21e644bc9ea81192d0a8b51ce9c0837c0996876abda3a7d482cfe03b9a3f7f7a

    SHA512

    1184290e18772bfcafef7968f1a047285cd92ba97b4e67cb0491dadca1757d27185db270962cb9318c1f868351d8fee7e65534575a2369c6e3b21abcdad3dd23

    Download Submit

  • /storage/emulated/0/Config/sys/apps/log/log-2024-12-17.txt
    Filesize

    12B

    MD5

    a9256f55737b655c8cff95418411997c

    SHA1

    d81a4e85ecef3a4f08d50da9c75c49a3c64ffe24

    SHA256

    bad705c44807d12463fb587087c4e9eb24769d82981229ac8b74abc9b1a44412

    SHA512

    10d10a6498973ed65d47c74ba6d8831dad94213a5071353dc445de46e021689284fbbf4accf5ba1f97a0675a7652ec069ac70f38d63ba36b8595a8caf8d37574

    Download Submit

  • /storage/emulated/0/Config/sys/apps/log/log-2024-12-17.txt
    Filesize

    32B

    MD5

    7240822fb8dcd1aa0c3a69137c7dcba2

    SHA1

    1a74a9309d020ca4433423a5ebb28c7caabf454b

    SHA256

    920fd239934c08565fde170c81dd16498ec465d1bcb1dfbd58fa52f521725b66

    SHA512

    3e057f1d894dff682d59f616f2f6d827743932edb603bf30b4d7ef06a35159d0b4b98f5dded28faa374df60ea9aaf6095a03b3a9bfe3e62be867cc4192f833e3

    Download Submit

  • /storage/emulated/0/Config/sys/apps/log/log-2024-12-17.txt
    Filesize

    267B

    MD5

    5a1cc8d893eced3bfa1572e380bc93c6

    SHA1

    3b8afd720811fdbaa169c042352f48b051df7da7

    SHA256

    c665fc8573713e82c523d1686e5a164806f02c764058b5156d12f2c1c4231066

    SHA512

    1d3c2e73d93773805b0c0b553280485ab6090650a3044fa313537de368c809e94a5884670527f6259d652ab54b217f6edc25108fe054b8b40a409788bf4dbd69

    Download Submit