Overview

overview

10

Static

static

6

0496F43DCC...84.apk

android-9-x86

10

0496F43DCC...84.apk

android-10-x64

10

0496F43DCC...84.apk

android-11-x64

10

Analysis

  • max time kernel
    34s
  • max time network
    157s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    20-01-2025 14:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0496F43DCC6C2E25BBF6D05A13E72DADC2AE6397FC617C935FD865F243FFD084.apk

  • Size

    2.6MB

  • MD5

    a1ba897aa937f4fde94652df43432935

  • SHA1

    272b2d9ca67d158d6f2a4635e52593e1d26838a7

  • SHA256

    0496f43dcc6c2e25bbf6d05a13e72dadc2ae6397fc617c935fd865f243ffd084

  • SHA512

    f4befd822b80ca631a648070683923013328755c912ff5623c0dc6b562dc12f1cd55d7a5de95d8c88f884c9f6bf435b0364c7b19d4b6f5737c46bd35e1b06498

  • SSDEEP

    49152:Almh0V89cuRnmdxx8aSkWKT9gMiQ4vhxCIcco0YavpvrATSOxphB:nh0IcuiYkpTmMiQ4px9O0YavpjAGOhB

Score
10/10
anubisbankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

anubis

C2

http://92.42.45.152/

Signatures

  • Anubis banker

    Android banker that uses overlays.

    bankertrojaninfostealeranubis
  • Anubis family
    anubis
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    defense_evasion

Processes

  • zjt.spoehyloohrstq.uaeldgadozprbyk
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4926

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json
    Filesize

    1.2MB

    MD5

    28432bebd94fb4dc9897c9489164aea3

    SHA1

    a7fef35657be61f0ec35d5e9742c6e0b46727b68

    SHA256

    fa572fb1e6e6e6bad03445643ef6f5256004a8e0dcc11f9c45cb2cfca7ada124

    SHA512

    a5eb0046c8d3b280e0c3c7080d2a645cb9a73918caa47ae95922e3051b13f1497a3426ff288592a8b86136b48c4cdf601d4d4c88d8ce59299b04eeb9111319af

    Download Submit

  • /data/data/zjt.spoehyloohrstq.uaeldgadozprbyk/app_DynamicOptDex/CalZ.json
    Filesize

    1.2MB

    MD5

    2438d05f0a10628d407c7bab3755f76a

    SHA1

    9c102c7552483372c2a2876bf83172e7bb254a06

    SHA256

    eb4f44de4ca5b9db02d437f4c4b1b05902f007fddd55c5fb226c7524c796b374

    SHA512

    5899e1cf4d9297032e961b5044e192f7728e5f8f6280f32b5ff22abd8c3df6ac0d13b2dcd8f190065f06f5450ae1382d8b216e90f954e274522932644b4f6eb3

    Download Submit