Overview

overview

10

Static

static

6

B6534569C6...F2.apk

android-9-x86

10

B6534569C6...F2.apk

android-10-x64

10

B6534569C6...F2.apk

android-11-x64

10

Resubmissions

17/02/2025, 13:54

250217-q71fqszket 10

17/02/2025, 13:54

250217-q7q73azjgq 6

17/02/2025, 12:50

250217-p3cnfaypen 10

Analysis

  • max time kernel
    60s
  • max time network
    149s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    17/02/2025, 12:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    B6534569C66B247263E086F3D0141B3F1E2B86C69423379FE8EB0480CE2123F2.apk

  • Size

    550KB

  • MD5

    a6442b382d8ddba47390bbd18fd3d1bd

  • SHA1

    8564d9093e51b7039aaa183901411163e913da2f

  • SHA256

    b6534569c66b247263e086f3d0141b3f1e2b86c69423379fe8eb0480ce2123f2

  • SHA512

    1ed5948b73533904f26f76ac04dffa17c930a89b4a062b79a102251d89cfef33233a413f710c4637016124c6dde787df0438e98a0e5ce3f7eb9a9aa115317ab0

  • SSDEEP

    12288:l/u2OaK0C2n3TdlMkF2EOW8vEdoiWepD/DREjDXB:xN40znDdPRfbW5ozDgx

Score
10/10
anubisbankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

anubis

C2

http://www.flashl1ght.top

Signatures

  • Anubis banker

    Android banker that uses overlays.

    bankertrojaninfostealeranubis
  • Anubis family
    anubis
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Requests enabling of the accessibility settings. 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    defense_evasion

Processes

  • com.xajzdrzcpbf.pmgxnve
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests enabling of the accessibility settings.
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4373
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xajzdrzcpbf.pmgxnve/app_files/gizcmxfchigm.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.xajzdrzcpbf.pmgxnve/app_files/oat/x86/gizcmxfchigm.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4398

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.xajzdrzcpbf.pmgxnve/app_files/gizcmxfchigm.jar
    Filesize

    177KB

    MD5

    528965397abdf6538fb83e97fa753e6f

    SHA1

    daabe5c88efbf74d227007fba4c625768472f980

    SHA256

    eb7445fb6d5cf52f08fd40d6139cae7e41b1a1505860506032dbd472b8c558bd

    SHA512

    3f82803cca40f151040222e264334bee7a1e97dc2ba4d47c23b05a3f86585cfbf9427dd84c76322da2ff5d78cc3da423f765a984e53d4bc5da1b67d261bc34b0

    Download Submit

  • /data/data/com.xajzdrzcpbf.pmgxnve/app_files/oat/gizcmxfchigm.jar.cur.prof
    Filesize

    244B

    MD5

    0f9046beaa6db139010895d018aec8f7

    SHA1

    759cc05a8b7a178be55859947376c6167154e3fe

    SHA256

    74f625070e26c51b6873b1c8ee321c374f901fcdc6cd512d76c470abc6962bd3

    SHA512

    1a73c5ca6bec7618e5269b21e2e80db6171bbaa271c34b8d9529cd0b7c723c37cd2a9513ec468351c335ebe42861e00da83806f2cda26f7fc281f0c07902e0e8

    Download Submit

  • /data/user/0/com.xajzdrzcpbf.pmgxnve/app_files/gizcmxfchigm.jar
    Filesize

    345KB

    MD5

    2067dc8df2364694919cdb3afaee7be6

    SHA1

    fb1f2add47c01a55ba2b085eb50477cc2065df9e

    SHA256

    8f48acba408d0877ff8456bb986f871bde2c9e5001509b709cd00357228631c7

    SHA512

    d2829561a04772270daabafc561db5799f6cf5617122a372eed8eb7907e950d8da87df8d061bd871317820a2650021d93a86a47ee21e9013d5c5076cccec7672

    Download Submit

  • /data/user/0/com.xajzdrzcpbf.pmgxnve/app_files/gizcmxfchigm.jar
    Filesize

    345KB

    MD5

    6df28f5149abf83c9163a12f3a7d017a

    SHA1

    16dfb6fd52c372b96b526b8c88856d141638cfc0

    SHA256

    29789de9b333f095ad630c854fb55c256207350cdee8fe24fdb143f0c4e96f6a

    SHA512

    23d6f4eeaccdeade1aae7d0f89e0912ed70d1284840efd0b28d2db1055e281f41ab9d7513f26baffd7ec76978b17eca2365db593e9b1121f22e798a02a675384

    Download Submit