Overview

overview

10

Static

static

6

B6534569C6...F2.apk

android-9-x86

10

B6534569C6...F2.apk

android-10-x64

10

B6534569C6...F2.apk

android-11-x64

10

Resubmissions

17/02/2025, 13:54

250217-q71fqszket 10

17/02/2025, 13:54

250217-q7q73azjgq 6

17/02/2025, 12:50

250217-p3cnfaypen 10

Analysis

  • max time kernel
    19s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    17/02/2025, 12:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    B6534569C66B247263E086F3D0141B3F1E2B86C69423379FE8EB0480CE2123F2.apk

  • Size

    550KB

  • MD5

    a6442b382d8ddba47390bbd18fd3d1bd

  • SHA1

    8564d9093e51b7039aaa183901411163e913da2f

  • SHA256

    b6534569c66b247263e086f3d0141b3f1e2b86c69423379fe8eb0480ce2123f2

  • SHA512

    1ed5948b73533904f26f76ac04dffa17c930a89b4a062b79a102251d89cfef33233a413f710c4637016124c6dde787df0438e98a0e5ce3f7eb9a9aa115317ab0

  • SSDEEP

    12288:l/u2OaK0C2n3TdlMkF2EOW8vEdoiWepD/DREjDXB:xN40znDdPRfbW5ozDgx

Score
10/10
anubisbankercollectioncredential_accessdefense_evasionevasioninfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

anubis

C2

http://www.flashl1ght.top

Signatures

  • Anubis banker

    Android banker that uses overlays.

    bankertrojaninfostealeranubis
  • Anubis family
    anubis
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Requests enabling of the accessibility settings. 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    defense_evasion

Processes

  • com.xajzdrzcpbf.pmgxnve
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests enabling of the accessibility settings.
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4783

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.xajzdrzcpbf.pmgxnve/app_files/gizcmxfchigm.jar
    Filesize

    177KB

    MD5

    528965397abdf6538fb83e97fa753e6f

    SHA1

    daabe5c88efbf74d227007fba4c625768472f980

    SHA256

    eb7445fb6d5cf52f08fd40d6139cae7e41b1a1505860506032dbd472b8c558bd

    SHA512

    3f82803cca40f151040222e264334bee7a1e97dc2ba4d47c23b05a3f86585cfbf9427dd84c76322da2ff5d78cc3da423f765a984e53d4bc5da1b67d261bc34b0

    Download Submit

  • /data/user/0/com.xajzdrzcpbf.pmgxnve/app_files/gizcmxfchigm.jar
    Filesize

    345KB

    MD5

    6df28f5149abf83c9163a12f3a7d017a

    SHA1

    16dfb6fd52c372b96b526b8c88856d141638cfc0

    SHA256

    29789de9b333f095ad630c854fb55c256207350cdee8fe24fdb143f0c4e96f6a

    SHA512

    23d6f4eeaccdeade1aae7d0f89e0912ed70d1284840efd0b28d2db1055e281f41ab9d7513f26baffd7ec76978b17eca2365db593e9b1121f22e798a02a675384

    Download Submit