Overview

overview

10

Static

static

6

B6534569C6...F2.apk

android-13-x64

10

Resubmissions

17-02-2025 13:54

250217-q71fqszket 10

17-02-2025 13:54

250217-q7q73azjgq 6

17-02-2025 12:50

250217-p3cnfaypen 10

Analysis

  • max time kernel
    29s
  • max time network
    37s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    17-02-2025 13:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    B6534569C66B247263E086F3D0141B3F1E2B86C69423379FE8EB0480CE2123F2.apk

  • Size

    550KB

  • MD5

    a6442b382d8ddba47390bbd18fd3d1bd

  • SHA1

    8564d9093e51b7039aaa183901411163e913da2f

  • SHA256

    b6534569c66b247263e086f3d0141b3f1e2b86c69423379fe8eb0480ce2123f2

  • SHA512

    1ed5948b73533904f26f76ac04dffa17c930a89b4a062b79a102251d89cfef33233a413f710c4637016124c6dde787df0438e98a0e5ce3f7eb9a9aa115317ab0

  • SSDEEP

    12288:l/u2OaK0C2n3TdlMkF2EOW8vEdoiWepD/DREjDXB:xN40znDdPRfbW5ozDgx

Score
10/10
anubisbankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

anubis

C2

http://www.flashl1ght.top

Signatures

  • Anubis banker

    Android banker that uses overlays.

    bankertrojaninfostealeranubis
  • Anubis family
    anubis
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Requests enabling of the accessibility settings. 1 IoCs

Processes

  • com.xajzdrzcpbf.pmgxnve
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Requests enabling of the accessibility settings.
    PID:4354

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.xajzdrzcpbf.pmgxnve/app_files/gizcmxfchigm.jar
    Filesize

    177KB

    MD5

    528965397abdf6538fb83e97fa753e6f

    SHA1

    daabe5c88efbf74d227007fba4c625768472f980

    SHA256

    eb7445fb6d5cf52f08fd40d6139cae7e41b1a1505860506032dbd472b8c558bd

    SHA512

    3f82803cca40f151040222e264334bee7a1e97dc2ba4d47c23b05a3f86585cfbf9427dd84c76322da2ff5d78cc3da423f765a984e53d4bc5da1b67d261bc34b0

    Download Submit

  • /data/user/0/com.xajzdrzcpbf.pmgxnve/app_files/gizcmxfchigm.jar
    Filesize

    345KB

    MD5

    6df28f5149abf83c9163a12f3a7d017a

    SHA1

    16dfb6fd52c372b96b526b8c88856d141638cfc0

    SHA256

    29789de9b333f095ad630c854fb55c256207350cdee8fe24fdb143f0c4e96f6a

    SHA512

    23d6f4eeaccdeade1aae7d0f89e0912ed70d1284840efd0b28d2db1055e281f41ab9d7513f26baffd7ec76978b17eca2365db593e9b1121f22e798a02a675384

    Download Submit