Overview

overview

10

Static

static

6

0496F43DCC...84.apk

android-9-x86

10

0496F43DCC...84.apk

android-10-x64

10

0496F43DCC...84.apk

android-11-x64

10

Analysis

  • max time kernel
    48s
  • max time network
    138s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    20-01-2025 14:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0496F43DCC6C2E25BBF6D05A13E72DADC2AE6397FC617C935FD865F243FFD084.apk

  • Size

    2.6MB

  • MD5

    a1ba897aa937f4fde94652df43432935

  • SHA1

    272b2d9ca67d158d6f2a4635e52593e1d26838a7

  • SHA256

    0496f43dcc6c2e25bbf6d05a13e72dadc2ae6397fc617c935fd865f243ffd084

  • SHA512

    f4befd822b80ca631a648070683923013328755c912ff5623c0dc6b562dc12f1cd55d7a5de95d8c88f884c9f6bf435b0364c7b19d4b6f5737c46bd35e1b06498

  • SSDEEP

    49152:Almh0V89cuRnmdxx8aSkWKT9gMiQ4vhxCIcco0YavpvrATSOxphB:nh0IcuiYkpTmMiQ4px9O0YavpjAGOhB

Score
10/10
anubisbankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

anubis

C2

http://92.42.45.152/

Signatures

  • Anubis banker

    Android banker that uses overlays.

    bankertrojaninfostealeranubis
  • Anubis family
    anubis
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Requests enabling of the accessibility settings. 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    defense_evasion

Processes

  • zjt.spoehyloohrstq.uaeldgadozprbyk
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests enabling of the accessibility settings.
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4260
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/oat/x86/CalZ.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4285

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json
    Filesize

    1.2MB

    MD5

    28432bebd94fb4dc9897c9489164aea3

    SHA1

    a7fef35657be61f0ec35d5e9742c6e0b46727b68

    SHA256

    fa572fb1e6e6e6bad03445643ef6f5256004a8e0dcc11f9c45cb2cfca7ada124

    SHA512

    a5eb0046c8d3b280e0c3c7080d2a645cb9a73918caa47ae95922e3051b13f1497a3426ff288592a8b86136b48c4cdf601d4d4c88d8ce59299b04eeb9111319af

    Download Submit

  • /data/data/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json
    Filesize

    1.2MB

    MD5

    2438d05f0a10628d407c7bab3755f76a

    SHA1

    9c102c7552483372c2a2876bf83172e7bb254a06

    SHA256

    eb4f44de4ca5b9db02d437f4c4b1b05902f007fddd55c5fb226c7524c796b374

    SHA512

    5899e1cf4d9297032e961b5044e192f7728e5f8f6280f32b5ff22abd8c3df6ac0d13b2dcd8f190065f06f5450ae1382d8b216e90f954e274522932644b4f6eb3

    Download Submit

  • /data/data/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/oat/CalZ.json.cur.prof
    Filesize

    281B

    MD5

    260aef09fdbf721baa504e6e711abb8a

    SHA1

    e5339c9448ee5ee1435c19593cd7d92fcdf7daf2

    SHA256

    9c79729f7687ea0ad21b8bb2023fa0fc9e839ffa3569fd95783dbd2c8433dcbf

    SHA512

    56850a00a220f1c4467dfc5ee5f86d2e373ce37ae92083ef54d52c6bd18b165e965ac2dc2be159d07b662c6c39081ff8b393c54775481f0dd008475ba1b23647

    Download Submit

  • /data/user/0/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json
    Filesize

    1.2MB

    MD5

    4fd88ec6522411859ab95b938bddf67a

    SHA1

    7b0f97c3fab5ccf0cddf22f63e93e21a1e2833e7

    SHA256

    4a883ece6252c46114c45613c120c8df97e42193d92b027292566fefcad352ed

    SHA512

    2e823919305db31cb16e7adefc10b86c5772843b96930e51a4b8f346c79e06fbc1222e09949c6cd2a08b23596b610142d822c37f8032b7d54c98932ac35d83da

    Download Submit