anubis | BASTIAN HEIN MALWARE SAMPLES 3[.]zip

Resubmissions

21/03/2026, 17:22

260321-vxselaht8v10

21/03/2026, 16:50

260321-vcmnlsbt4r10

Sharing

Copy URL Twitter E-mail

General

Target
BASTIAN HEIN MALWARE SAMPLES 3.zip
Size 18.7MB
Sample260321-vcmnlsbt4r
SHA256 92b568ea66a29ff6a29ca0ce5d35860313846a5e3668c353087a64f898c5f365
MD5 840dd13e80d008abdd7c7d8c8083a9f0
SHA1 3a2e0b8f1c9188f070bb0c19b32c95c491b5ef3c
SHA512 3eed8a2ce24ff9e16c56a8f9a25f6a26ece9bcc22737822ba9bfd78d4f7b8c896b94d93fb509ecd4a6746c4a569f395de4f7fc765af4b33e97edad0ae9cbdde1
SSDEEP 393216:yhcRWEUL2IWx4hn6rUgG++K74eHp+3UrPL55DBCRA5p1WxRexWr1O:yhcRTO2INErUg97445yAf1W+xeO
TLSH
T176170143E3E8A514F4F39B325EB501659A3ABC856A33DA4F1214712D1DB7FD08E90BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

anubis

Malware Config

Extracted

Family

anubis

http://cdnjs.su
http://ktosdelaetskrintotpidor.com
http://sositehuypidarasi.com

Attributes

target_apps
MyING.be

aib.ibank.android

alior.bankingapp.android

at.easybank.securityapp

at.psa.app.bawag

at.spardat.bcrmobile

at.spardat.netbanking

au.com.bankwest.mobile

au.com.cua.mb

au.com.mebank.banking

au.com.nab.mobile

au.com.newcastlepermanent

au.com.suncorp.SuncorpBank

ccom.tmob.denizbank

com.DijitalSahne.EnYakinHalkbank

com.FubonMobileClient

com.MobileTreeApp

com.Plus500

com.abnamro.nl.mobile.payments

com.advantage.RaiffeisenBank

com.aff.otpdirekt

com.amazon.windowshop

com.att.myWireless

com.axis.mobile

com.bankaustria.android.olb

com.bankia.wallet

com.bankinter.launcher

com.bankofamerica.cashpromobile

com.bankofqueensland.boq

com.barclays.android.barclaysmobilebanking

com.barclays.ke.mobile.android.ui

com.bbnt

com.bbva.bbvawallet

com.bbva.netcash

com.binance.dev

com.binance.odapplications

com.bitcoin.ss.zebpayindia

com.bitfinex.bfxapp

com.bitmarket.trader

com.bitmarket.trader

com.blockfolio.blockfolio

com.bmo.mobile

com.boursorama.android.clients

com.bssys.vtb.mobileclient

com.btcturk

com.btcturk

com.caisseepargne.android.mobilebanking

com.cba.android.netbank

com.chase.sig.android

com.cibc.android.mobi

com.citi.citimobile

com.clairmail.fth

com.cleverlance.csas.servis24

com.cm_prod.nosactus

com.coin.profit

com.coinbase.android

com.coins.bit.local

com.coins.ful.bit

com.comarch.mobile.banking.bgzbnpparibas.biznes

com.comarch.security.mobilebanking

com.crypter.cryptocyrrency

com.csam.icici.bank.imobile

com.csg.cs.dnmbs

com.db.mm.deutschebank

com.db.mm.norisbank

com.db.pwcc.dbmobile

com.dbs.hk.dbsmbanking

com.de.dkb.portalapp

com.discoverfinancial.mobile

com.eastwest.mobile

com.ebay.mobile

com.edsoftapps.mycoinsvalue

com.empik.empikapp

com.empik.empikfoto

com.fi6122.godough

com.fi6256.godough

com.fi6543.godough

com.fi6665.godough

com.fi9228.godough

com.fi9908.godough

com.finansbank.mobile.cepsube

com.finanteq.finance.ca

com.fragment.akbank

com.fuib.android.spot.online

com.fusion.ATMLocator

com.garantiyatirim.fx

com.getingroup.mobilebanking

com.grppl.android.shell.BOS

com.grppl.android.shell.CMBlloydsTSB73

com.grppl.android.shell.halifax

com.hangseng.rbmobile

com.htsu.hsbcpersonalbanking

com.idbi.mpassbook

com.ideomobile.hapoalim

com.ifs.banking.fiid1369

com.ifs.mobilebanking.fiid3919

com.imb.banking2

com.infrasofttech.indianBank

com.ing.diba.mbbr2

com.ing.mobile

com.ingbanktr.ingmobil

com.isis_papyrus.raiffeisen_pay_eyewdg

com.jackhenry.rockvillebankct

com.jackhenry.washingtontrustbankwa

com.jackpf.blockchainsearch

com.jamalabbasii1998.localbitcoin

com.jiffyondemand.user

com.jpm.sig.android

com.kryptokit.jaxx

com.kutxabank.android

com.kuveytturk.mobil

com.kuveytturk.mobil

com.latuabanca_tabperandroid

com.latuabancaperandroid

com.localbitcoins.exchange

com.localbitcoinsmbapp

com.lynxspa.bancopopolare

com.magiclick.odeabank

com.magiclick.odeabank

com.mal.saul.coinmarketcap

com.matriksdata.ziraatyatirim.pad

com.mobikwik_new

com.mobillium.papara

com.mobillium.papara

com.moneybookers.skrillpayments

com.moneybookers.skrillpayments.neteller

com.monitise.isbankmoscow

com.mtel.androidbea

com.mycelium.wallet

com.orangefinansek

com.oxigen.oxigenwallet

com.palatine.android.mobilebanking.prod

com.paypal.android.p2pmobile

com.plunien.poloniex

com.portfolio.coinbase_tracker

com.pozitron.albarakaturk

com.pozitron.albarakaturk

com.pozitron.iscep

com.pozitron.vakifbank

com.quickmobile.anzirevents15

com.rbc.mobile.android

com.rbs.mobile.android.natwestbandc

com.rbs.mobile.android.rbsbandc

com.rbs.mobile.android.ubr

com.redrockdigimark

com.rsi

com.santander.app

com.sbi.SBIFreedomPlus

com.scb.breezebanking.hk

com.scotiabank.mobile

com.snapwork.hdfc

com.sovereign.santander

com.starfinanz.smob.android.sbanking

com.starfinanz.smob.android.sfinanzstatus.tablet

com.sterling.onepay

com.suntrust.mobilebanking

com.svb.mobilebanking

com.targo_prod.bad

com.td

com.teb

com.teb

com.tecnocom.cajalaboral

com.thunkable.android.manirana54.LocalBitCoins

com.thunkable.android.manirana54.LocalBitCoins_unblock

com.thunkable.android.santoshmehta364.UNOCOIN_LIVE

com.tmob.denizbank

com.tmob.tabletdeniz

com.tnx.apps.coinportfolio

com.triodos.bankingnl

com.ukrsibbank.client.android

com.unicredit

com.unionbank.ecommerce.mobile.commercial.legacy

com.unionbank.ecommerce.mobile.commercial.legacy

com.unocoin.unocoinmerchantPoS

com.unocoin.unocoinwallet

com.usaa.mobile.android.usaa

com.usbank.mobilebanking

com.vakifbank.mobilel

com.veripark.ykbaz

com.vzw.hss.myverizon

com.wellsFargo.ceomobile

com.yinzcam.facilities.verizon

com.ykb.android

cz.airbank.android

cz.csob.smartbanking

cz.sberbankcz

de.comdirect.android

de.commerzbanking.mobil

de.consorsbank

de.fiducia.smartphone.android.banking.vr

de.postbank.finanzassistent

de.schildbach.wallet

es.bancopopular.nbmpopular

es.evobanco.bancamovil

es.lacaixa.mobile.android.newwapicon

eu.eleader.mobilebanking.invest

eu.eleader.mobilebanking.pekao

eu.eleader.mobilebanking.pekao.firm

eu.eleader.mobilebanking.raiffeisen

eu.inmite.prj.kb.mobilbank

eu.unicreditgroup.hvbapptan

finansbank.enpara

fr.axa.monaxa

fr.banquepopulaire.cyberplus

fr.creditagricole.androidapp

fr.laposte.lapostetablet

fr.lcl.android.customerarea

hdfcbank.hdfcquickbank

hk.com.hsbc.hsbchkmobilebanking

hr.asseco.android.jimba.mUCI.ro

in.co.bankofbaroda.mpassbook

info.blockchain.merchant

io.getdelta.android

it.bnl.apps.banking

it.bnl.apps.enterprise.bnlpay

it.bpc.proconl.mbplus

it.copergmps.rt.pf.android.sp.bmps

it.gruppocariparma.nowbanking

it.ingdirect.app

it.nogood.container

it.popso.SCRIGNOapp

jp.co.aeonbank.android.passbook

jp.co.netbk

jp.co.rakuten_bank.rakutenbank

jp.co.sevenbank.AppPassbook

jp.co.smbc.direct

jp.mufg.bk.applisp.app

may.maybank.android

me.doubledutch.hvdnz.cbnationalconference2016

mobi.societegenerale.mobile.lappli

mobile.santander.de

net.bnpparibas.mescomptes

nl.asnbank.asnbankieren

nl.snsbank.mobielbetalen

nz.co.anz.android.mobilebanking

nz.co.asb.asbmobile

nz.co.bnz.droidbanking

nz.co.kiwibank.mobile

nz.co.westpac

org.banksa.bank

org.bom.bank

org.stgeorge.bank

org.usemployees.mobile

pinacleMobileiPhoneApp.android

piuk.blockchain.android

pl.aliorbank.aib

pl.allegro

pl.bosbank.mobile

pl.bph

pl.bps.bankowoscmobilna

pl.bzwbk.bzwbk24

pl.bzwbk.ibiznes24

pl.bzwbk.mobile.tab.bzwbk24

pl.ceneo

pl.com.rossmann.centauros

pl.fmbank.smart

pl.ideabank.mobilebanking

pl.ing.mojeing

pl.ipko.mobile

pl.mbank

pl.millennium.corpApp

pl.orange.mojeorange

pl.pkobp.iko

pl.pkobp.ipkobiznes

posteitaliane.posteapp.apppostepay

ro.btrl.mobile

ru.alfabank.mobile.ua.android

ru.alfadirect.app

ru.mw

ru.sberbank.sberbankir

ru.tinkoff.goabroad

sk.sporoapps.skener

tr.com.hsbc.hsbcturkey

tr.com.sekerbilisim.mbank

tr.com.sekerbilisim.mbank

ua.aval.dbo.client.android

ua.com.cs.ifobs.mobile.android.otp

ua.com.cs.ifobs.mobile.android.pivd

ua.oschadbank.online

ua.privatbank.ap24

wit.android.bcpBankingApp.millenniumPL

wos.com.zebpay

zebpay.Application

Signatures

Anubis family
anubis

Anubis payload 1 IoCs

resource	yara_rule
static1/unpack001/c38c675a4342052a18e969e839cce797fef842b9d53032882966a3731ced0a70.apk	family_anubis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR
Allows an application to write the user's calendar data.	android.permission.WRITE_CALENDAR
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

Codesign digest Mismatch 2 IoCs

File was altered after it was signed.

resource
unpack001/Business Calendar Pro.apk
unpack001/Collage Creator.apk

Insecure Codesign Algorithm 6 IoCs

File was codesigned using an insecure algorithm.

resource
unpack001/Business Calendar Pro.apk
unpack001/Collage Creator.apk
unpack001/Conference.apk
unpack001/c38c675a4342052a18e969e839cce797fef842b9d53032882966a3731ced0a70.apk
unpack001/chinese_locker.apk
unpack001/com.crazyapps.angry.birds.multi.user.apk

Untrusted Codesign Signers 12 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/Business Calendar Pro.apk
unpack001/Calculator 1.apk
unpack001/Calculator.apk
unpack001/Chinese Nulls Brawl Virus(Telegram @APXUBbl_BUPYCOB).apk
unpack001/Collage Creator.apk
unpack001/Conference.apk
unpack001/Counter-Strike_1.6_1.0.apk
unpack001/c38c675a4342052a18e969e839cce797fef842b9d53032882966a3731ced0a70.apk
unpack001/chinese_locker.apk
unpack001/com.AngryNeighbor.apk
unpack001/com.crazyapps.angry.birds.multi.user.apk
unpack001/com.my.kfckfcgrrgihhk.apk

File Explorer

BASTIAN HEIN MALWARE SAMPLES 3.zip

.zip 18.7MB
Business Calendar Pro.apk

.apk 3.2MB
Calculator 1.apk

.apk 424KB
Calculator.apk

.apk 1.6MB
Chinese Nulls Brawl Virus(Telegram @APXUBbl_BUPYCOB).apk

.apk 566KB
Collage Creator.apk

.apk 9.4MB
Conference.apk

.apk 326KB
Counter-Strike_1.6_1.0.apk

.apk 148KB
c38c675a4342052a18e969e839cce797fef842b9d53032882966a3731ced0a70.apk

.apk 561KB
chinese_locker.apk

.apk 43KB
com.AngryNeighbor.apk

.apk 2.1MB
com.crazyapps.angry.birds.multi.user.apk

.apk 40KB
com.my.kfckfcgrrgihhk.apk

.apk 449KB

BASTIAN HEIN MALWARE SAMPLES 3.zip

SHA256 92b568ea66a29ff6a29ca0ce5d35860313846a5e3668c353087a64f898c5f365
MD5 840dd13e80d008abdd7c7d8c8083a9f0
SHA1 3a2e0b8f1c9188f070bb0c19b32c95c491b5ef3c
SHA512 3eed8a2ce24ff9e16c56a8f9a25f6a26ece9bcc22737822ba9bfd78d4f7b8c896b94d93fb509ecd4a6746c4a569f395de4f7fc765af4b33e97edad0ae9cbdde1
SSDEEP 393216:yhcRWEUL2IWx4hn6rUgG++K74eHp+3UrPL55DBCRA5p1WxRexWr1O:yhcRTO2INErUg97445yAf1W+xeO
TLSH
T176170143E3E8A514F4F39B325EB501659A3ABC856A33DA4F1214712D1DB7FD08E90BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Business Calendar Pro.apk

SHA256 f8467ae8c653c6c34f1736e16258a47a3b358870b1d1b9280770a2c6555a2cb2
MD5 bccc62ae0129d484f0407fedd701d211
SHA1 3c7a287b7f7013692847b8ed9dbd78d32786445a
SHA512 3dd3ef895b74bdd8701f0b5487b0f2216c5a9887f302aa74cdae98f65cf8b285184d203ab85ebebd0e701e7f671673d798c3342a87ccb8dfa080a28b6f3036b8
SSDEEP 49152:FF+pkL0aYWymUgGgly3fYf+m635en/Ed+J/pM:FF+pkym7crmcencd0M
TLSH
T142F51743E3F86518F5F36B35AEB511619A3ABD817A36D94E1210316E1CB3FD08A60B73
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm

Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

036afd511aa7610938ef8917a371639d299a7b5b

Digest Algorithm

sha1

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

Chains

Jan 1, 0001

mikado.bizcalpro

mikado.bizcalpro.alerts.ReminderActivity

.main

android.intent.action.MAIN

mikado.bizcalpro.DummyActivity

mikado.bizcalpro.alerts.SnoozeTimeActivity

mikado.bizcalpro.alerts.MeetingResponseActivity

mikado.bizcalpro.MonthActivity

mikado.bizcalpro.WeekActivity

mikado.bizcalpro.DayActivity

mikado.bizcalpro.YearActivity

mikado.bizcalpro.IcalExportActivity

mikado.bizcalpro.IcalImportActivity

android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW

mikado.bizcalpro.AppointmentListActivity

mikado.bizcalpro.AppointmentViewActivity

android.intent.action.VIEW

mikado.bizcalpro.GoogleCalendarUriIntentFilter

android.intent.action.VIEW

mikado.bizcalpro.NewEditEventActivity

android.intent.action.EDIT android.intent.action.SEND

mikado.bizcalpro.CalendarSelectionActivity

mikado.bizcalpro.LocalCalendarActivity

mikado.bizcalpro.SettingsActivity

mikado.bizcalpro.HelpActivity

mikado.bizcalpro.CalendarColorActivity

mikado.bizcalpro.ReportProblemActivity

mikado.bizcalpro.FontSizesActivity

mikado.bizcalpro.WidgetsSelectionActivity

mikado.bizcalpro.DateSelectionActivity

mikado.bizcalpro.TimeSelectionActivity

mikado.bizcalpro.IndividualReminderActivity

mikado.bizcalpro.TemplateSaveActivity

mikado.bizcalpro.TemplatesListActivity

mikado.bizcalpro.HistoryListActivity

mikado.bizcalpro.HistoryAutoFillActivity

mikado.bizcalpro.alerts.ReminderSettingsActivity

mikado.bizcalpro.alerts.ReminderSettingsIndividualRingtoneActivity

mikado.bizcalpro.FavoriteBarSetupActivity

mikado.bizcalpro.themes.selection.ThemeSelectionActivity

mikado.bizcalpro.YearColoringModeActivity

mikado.bizcalpro.ColorPickerActivity

mikado.bizcalpro.EventColorSelectionActivity

mikado.bizcalpro.TasksAddonActivity

mikado.bizcalpro.EmailAnswersActivity

mikado.bizcalpro.EmailAnswersEditActivity

mikado.bizcalpro.alerts.OngoingNotificationSettingsActivity

mikado.bizcalpro.BatchOperationReccurentEventsDialog

mikado.bizcalpro.BatchOperationMarkRangeDialog