anubis | 92b568ea66a29ff6a29ca0ce5d35860313846a5e3668c353087a64f898c5f365

Resubmissions

21/03/2026, 17:22

260321-vxselaht8v10

21/03/2026, 16:50

260321-vcmnlsbt4r10

Sharing

Copy URL Twitter E-mail

General

Target
BASTIAN HEIN MALWARE SAMPLES 3.zip
Size 18.7MB
Sample260321-vxselaht8v
SHA256 92b568ea66a29ff6a29ca0ce5d35860313846a5e3668c353087a64f898c5f365
MD5 840dd13e80d008abdd7c7d8c8083a9f0
SHA1 3a2e0b8f1c9188f070bb0c19b32c95c491b5ef3c
SHA512 3eed8a2ce24ff9e16c56a8f9a25f6a26ece9bcc22737822ba9bfd78d4f7b8c896b94d93fb509ecd4a6746c4a569f395de4f7fc765af4b33e97edad0ae9cbdde1
SSDEEP 393216:yhcRWEUL2IWx4hn6rUgG++K74eHp+3UrPL55DBCRA5p1WxRexWr1O:yhcRTO2INErUg97445yAf1W+xeO
TLSH
T176170143E3E8A514F4F39B325EB501659A3ABC856A33DA4F1214712D1DB7FD08E90BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

anubis

http://cdnjs.su
http://ktosdelaetskrintotpidor.com
http://sositehuypidarasi.com

Attributes

target_apps
MyING.be

aib.ibank.android

alior.bankingapp.android

at.easybank.securityapp

at.psa.app.bawag

at.spardat.bcrmobile

at.spardat.netbanking

au.com.bankwest.mobile

au.com.cua.mb

au.com.mebank.banking

au.com.nab.mobile

au.com.newcastlepermanent

au.com.suncorp.SuncorpBank

ccom.tmob.denizbank

com.DijitalSahne.EnYakinHalkbank

com.FubonMobileClient

com.MobileTreeApp

com.Plus500

com.abnamro.nl.mobile.payments

com.advantage.RaiffeisenBank

com.aff.otpdirekt

com.amazon.windowshop

com.att.myWireless

com.axis.mobile

com.bankaustria.android.olb

com.bankia.wallet

com.bankinter.launcher

com.bankofamerica.cashpromobile

com.bankofqueensland.boq

com.barclays.android.barclaysmobilebanking

com.barclays.ke.mobile.android.ui

com.bbnt

com.bbva.bbvawallet

com.bbva.netcash

com.binance.dev

com.binance.odapplications

com.bitcoin.ss.zebpayindia

com.bitfinex.bfxapp

com.bitmarket.trader

com.bitmarket.trader

com.blockfolio.blockfolio

com.bmo.mobile

com.boursorama.android.clients

com.bssys.vtb.mobileclient

com.btcturk

com.btcturk

com.caisseepargne.android.mobilebanking

com.cba.android.netbank

com.chase.sig.android

com.cibc.android.mobi

com.citi.citimobile

com.clairmail.fth

com.cleverlance.csas.servis24

com.cm_prod.nosactus

com.coin.profit

com.coinbase.android

com.coins.bit.local

com.coins.ful.bit

com.comarch.mobile.banking.bgzbnpparibas.biznes

com.comarch.security.mobilebanking

com.crypter.cryptocyrrency

com.csam.icici.bank.imobile

com.csg.cs.dnmbs

com.db.mm.deutschebank

com.db.mm.norisbank

com.db.pwcc.dbmobile

com.dbs.hk.dbsmbanking

com.de.dkb.portalapp

com.discoverfinancial.mobile

com.eastwest.mobile

com.ebay.mobile

com.edsoftapps.mycoinsvalue

com.empik.empikapp

com.empik.empikfoto

com.fi6122.godough

com.fi6256.godough

com.fi6543.godough

com.fi6665.godough

com.fi9228.godough

com.fi9908.godough

com.finansbank.mobile.cepsube

com.finanteq.finance.ca

com.fragment.akbank

com.fuib.android.spot.online

com.fusion.ATMLocator

com.garantiyatirim.fx

com.getingroup.mobilebanking

com.grppl.android.shell.BOS

com.grppl.android.shell.CMBlloydsTSB73

com.grppl.android.shell.halifax

com.hangseng.rbmobile

com.htsu.hsbcpersonalbanking

com.idbi.mpassbook

com.ideomobile.hapoalim

com.ifs.banking.fiid1369

com.ifs.mobilebanking.fiid3919

com.imb.banking2

com.infrasofttech.indianBank

com.ing.diba.mbbr2

com.ing.mobile

com.ingbanktr.ingmobil

com.isis_papyrus.raiffeisen_pay_eyewdg

com.jackhenry.rockvillebankct

com.jackhenry.washingtontrustbankwa

com.jackpf.blockchainsearch

com.jamalabbasii1998.localbitcoin

com.jiffyondemand.user

com.jpm.sig.android

com.kryptokit.jaxx

com.kutxabank.android

com.kuveytturk.mobil

com.kuveytturk.mobil

com.latuabanca_tabperandroid

com.latuabancaperandroid

com.localbitcoins.exchange

com.localbitcoinsmbapp

com.lynxspa.bancopopolare

com.magiclick.odeabank

com.magiclick.odeabank

com.mal.saul.coinmarketcap

com.matriksdata.ziraatyatirim.pad

com.mobikwik_new

com.mobillium.papara

com.mobillium.papara

com.moneybookers.skrillpayments

com.moneybookers.skrillpayments.neteller

com.monitise.isbankmoscow

com.mtel.androidbea

com.mycelium.wallet

com.orangefinansek

com.oxigen.oxigenwallet

com.palatine.android.mobilebanking.prod

com.paypal.android.p2pmobile

com.plunien.poloniex

com.portfolio.coinbase_tracker

com.pozitron.albarakaturk

com.pozitron.albarakaturk

com.pozitron.iscep

com.pozitron.vakifbank

com.quickmobile.anzirevents15

com.rbc.mobile.android

com.rbs.mobile.android.natwestbandc

com.rbs.mobile.android.rbsbandc

com.rbs.mobile.android.ubr

com.redrockdigimark

com.rsi

com.santander.app

com.sbi.SBIFreedomPlus

com.scb.breezebanking.hk

com.scotiabank.mobile

com.snapwork.hdfc

com.sovereign.santander

com.starfinanz.smob.android.sbanking

com.starfinanz.smob.android.sfinanzstatus.tablet

com.sterling.onepay

com.suntrust.mobilebanking

com.svb.mobilebanking

com.targo_prod.bad

com.td

com.teb

com.teb

com.tecnocom.cajalaboral

com.thunkable.android.manirana54.LocalBitCoins

com.thunkable.android.manirana54.LocalBitCoins_unblock

com.thunkable.android.santoshmehta364.UNOCOIN_LIVE

com.tmob.denizbank

com.tmob.tabletdeniz

com.tnx.apps.coinportfolio

com.triodos.bankingnl

com.ukrsibbank.client.android

com.unicredit

com.unionbank.ecommerce.mobile.commercial.legacy

com.unionbank.ecommerce.mobile.commercial.legacy

com.unocoin.unocoinmerchantPoS

com.unocoin.unocoinwallet

com.usaa.mobile.android.usaa

com.usbank.mobilebanking

com.vakifbank.mobilel

com.veripark.ykbaz

com.vzw.hss.myverizon

com.wellsFargo.ceomobile

com.yinzcam.facilities.verizon

com.ykb.android

cz.airbank.android

cz.csob.smartbanking

cz.sberbankcz

de.comdirect.android

de.commerzbanking.mobil

de.consorsbank

de.fiducia.smartphone.android.banking.vr

de.postbank.finanzassistent

de.schildbach.wallet

es.bancopopular.nbmpopular

es.evobanco.bancamovil

es.lacaixa.mobile.android.newwapicon

eu.eleader.mobilebanking.invest

eu.eleader.mobilebanking.pekao

eu.eleader.mobilebanking.pekao.firm

eu.eleader.mobilebanking.raiffeisen

eu.inmite.prj.kb.mobilbank

eu.unicreditgroup.hvbapptan

finansbank.enpara

fr.axa.monaxa

fr.banquepopulaire.cyberplus

fr.creditagricole.androidapp

fr.laposte.lapostetablet

fr.lcl.android.customerarea

hdfcbank.hdfcquickbank

hk.com.hsbc.hsbchkmobilebanking

hr.asseco.android.jimba.mUCI.ro

in.co.bankofbaroda.mpassbook

info.blockchain.merchant

io.getdelta.android

it.bnl.apps.banking

it.bnl.apps.enterprise.bnlpay

it.bpc.proconl.mbplus

it.copergmps.rt.pf.android.sp.bmps

it.gruppocariparma.nowbanking

it.ingdirect.app

it.nogood.container

it.popso.SCRIGNOapp

jp.co.aeonbank.android.passbook

jp.co.netbk

jp.co.rakuten_bank.rakutenbank

jp.co.sevenbank.AppPassbook

jp.co.smbc.direct

jp.mufg.bk.applisp.app

may.maybank.android

me.doubledutch.hvdnz.cbnationalconference2016

mobi.societegenerale.mobile.lappli

mobile.santander.de

net.bnpparibas.mescomptes

nl.asnbank.asnbankieren

nl.snsbank.mobielbetalen

nz.co.anz.android.mobilebanking

nz.co.asb.asbmobile

nz.co.bnz.droidbanking

nz.co.kiwibank.mobile

nz.co.westpac

org.banksa.bank

org.bom.bank

org.stgeorge.bank

org.usemployees.mobile

pinacleMobileiPhoneApp.android

piuk.blockchain.android

pl.aliorbank.aib

pl.allegro

pl.bosbank.mobile

pl.bph

pl.bps.bankowoscmobilna

pl.bzwbk.bzwbk24

pl.bzwbk.ibiznes24

pl.bzwbk.mobile.tab.bzwbk24

pl.ceneo

pl.com.rossmann.centauros

pl.fmbank.smart

pl.ideabank.mobilebanking

pl.ing.mojeing

pl.ipko.mobile

pl.mbank

pl.millennium.corpApp

pl.orange.mojeorange

pl.pkobp.iko

pl.pkobp.ipkobiznes

posteitaliane.posteapp.apppostepay

ro.btrl.mobile

ru.alfabank.mobile.ua.android

ru.alfadirect.app

ru.mw

ru.sberbank.sberbankir

ru.tinkoff.goabroad

sk.sporoapps.skener

tr.com.hsbc.hsbcturkey

tr.com.sekerbilisim.mbank

tr.com.sekerbilisim.mbank

ua.aval.dbo.client.android

ua.com.cs.ifobs.mobile.android.otp

ua.com.cs.ifobs.mobile.android.pivd

ua.oschadbank.online

ua.privatbank.ap24

wit.android.bcpBankingApp.millenniumPL

wos.com.zebpay

zebpay.Application

Extracted

Family

anubis

http://ktosdelaetskrintotpidor.com
http://sositehuypidarasi.com

Targets

- Target
  Business Calendar Pro.apk
- Size 3.2MB
- SHA256 f8467ae8c653c6c34f1736e16258a47a3b358870b1d1b9280770a2c6555a2cb2
- MD5 bccc62ae0129d484f0407fedd701d211
- SHA1 3c7a287b7f7013692847b8ed9dbd78d32786445a
- SHA512 3dd3ef895b74bdd8701f0b5487b0f2216c5a9887f302aa74cdae98f65cf8b285184d203ab85ebebd0e701e7f671673d798c3342a87ccb8dfa080a28b6f3036b8
- SSDEEP 49152:FF+pkL0aYWymUgGgly3fYf+m635en/Ed+J/pM:FF+pkym7crmcencd0M
- TLSH
  T142F51743E3F86518F5F36B35AEB511619A3ABD817A36D94E1210316E1CB3FD08A60B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Calculator 1.apk
- Size 424KB
- SHA256 ae7effbd904568f1ae67a01aaa2579b2f5803df0beaec75c1fbc7e9d076a1d5d
- MD5 33b49207ff44345ef5fd78c24bb20787
- SHA1 49fc6c8855605e609bdee3a045c21fe78784bb22
- SHA512 bcb896e2689f2687c859bd3f2bb2fb57509be40f15882a4cd2ab4121c128a85f66847554d33bfc40f62ff804c57c3fc289096749597b490d8dc32008ec1db83d
- SSDEEP 6144:TU5KFcQnKg76o4Yyw/VZ74Srp7VPeuFz33xGpN/eO9QgTohN9CK/2R:tFLKzo4Zw9ySrveuxRGpBmgMhN4a2R
- TLSH
  T11F9423EAAE44DEB6DBE640BEF9F4E511EDE303B745C2D395890A720164676280FE1309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Calculator.apk
- Size 1.6MB
- SHA256 3a383dc8d0b74d8186dc42b16b8d1f98597e88ec049593e8a8f618779c50accf
- MD5 23d81292afe2a554c544f9dde5d92480
- SHA1 c6cfd8eec45c83336824f4be088ed30a4f4c9d40
- SHA512 db52d13a4eaf42acc72e0c9a265dcd4655dbdff89dc58deb23849845bf3297e3a50126042d0aaf26af2ab6fe0bcaae8696a74b89a73cc45aa1f694ca49522969
- SSDEEP 49152:A3Ii3N0wYYJwSQPaRrVulLtmouig4Bmll:A3v0OWEVWLvu+mll
- TLSH
  T13085BE85FF18E42FD9B784334AB6023656568C4E8A82E74346E9B21C5DB7AC44FC5FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Chinese Nulls Brawl Virus(Telegram @APXUBbl_BUPYCOB).apk
- Size 566KB
- SHA256 7a0d9a3c94f7d81ac627a20a02b425603d2f6ec3b997004a32d5c3105f92e52f
- MD5 957b7514943671f4248b99bf11d52455
- SHA1 f4d945cdca2167ef61ba544ec6e71973c9ca5920
- SHA512 248577cd8de9cbc990f4c51109e2e22cdbddb0cf3d173db53aafb7ca4fa9958d9ff25b317246ef7bfbd70a64a8992bd3399a5d7b184757aa3a1efbe3e74107e6
- SSDEEP 12288:7t8SRIGYoVTWpPRSBpD41leMx4PsvRO33ncp4:7ySRIGYoVysD4neMSHM4
- TLSH
  T1CBC4AE83E308A9A3CCF7DA334676176A4297DD254747AB871C94723C09BF6D02B59EC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
behavioral4
- Target
  Collage Creator.apk
- Size 9.4MB
- SHA256 27cd0366117cc9204121518a0fdb9eeaba8234cda9704bee0c310b1ae7b1bb79
- MD5 de842dd94324492ace8c2c8ebd350bc8
- SHA1 e8c4413af987ec625a8a5dde456d322d4ac106c9
- SHA512 a52965523a83f85b14d1598dc5fbd6e45e28c8f035bb82e622506754b4d61d19253d7b1ba07ecd16d077790dac6c2e22ee38216341ba05fc859949ca3cf2e014
- SSDEEP 196608:1oUx4hGg6rUgE12P2++KsTCJ54eABP6p+3CXdFvHL5BvtRDe+CmFSA5GA1WSFr:dx4hn6rUgG++K74eHp+3UrPL55DBCRA1
- TLSH
  T1F9A633A2C346FF21E466C5364BB6406F7A110DC05952EB66317EF4225FFFAA0C944F8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access discovery impact
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral5
- Target
  Conference.apk
- Size 326KB
- SHA256 369eecee148387358499fc02595d3849b8c5aebaa42f4ca4aea3644eda3aa6ef
- MD5 0b8806b38b52bebfe39ff585639e2ea2
- SHA1 b6511332331bc8bc64e8bdb1cd915592b29f4606
- SHA512 e85b7ba07dbce233ce98f6400aa230a7e7d2d4721d36c8bc33b6025481b3579b8b04e82d959d36ab70f3d72711237021a6736d8c60f849cffc712b0f625dfcc5
- SSDEEP 6144:nJQ5gBbyHPhuiwxm28KYdjMIIMshfteSIv8Imyv2TpKCV3FqRsG26oNM:JjBeHPhYAhHBMeeeSAJv2TpKCVOsyeM
- TLSH
  T14B642381FB9D27A3E446A0F28A4CEAD049CC69C6E739433E774CD067B519DC0A185FE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Queries information about active data network
  discovery
behavioral6
- Target
  Counter-Strike_1.6_1.0.apk
- Size 148KB
- SHA256 962dfd62af80e49d03f414879cdb694819fa71c496e6cec412ddf8c4fa957162
- MD5 5b68608cd248d6d5fe42d824f75db7c1
- SHA1 0f576931f532a6b999838da467c31d092c7f081b
- SHA512 d97c64bbdff2ad0534b0e1ffab4042920987aea09fef2e4f5cc875b53cfa208b641f963cb0beb1b25c8f35b7bd3c52536e2cf2891d9d868c0e090a687091fc74
- SSDEEP 3072:Fql6Fus/ypYroYwBMAghNZV68C69/T9oYMMx:qy/yTqhN9CK/T+YNx
- TLSH
  T16FE313A35B74AD5BD97D7C7D55F8D236EE72130320A0C78F4A17C1117E824BA0CA865E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  c38c675a4342052a18e969e839cce797fef842b9d53032882966a3731ced0a70.apk
- Size 561KB
- SHA256 c38c675a4342052a18e969e839cce797fef842b9d53032882966a3731ced0a70
- MD5 c027ec0f9855529877bc0d57453c5e86
- SHA1 7b5e31a41c9220330146d8a173b21512971c74a2
- SHA512 78c12d46dc15ce52cc1ccbedd8b1762f6a594b44e72c80974eec19dc575b07f0db994b568ec78ab51ccdbf02e93ba0dff9f3b1a5f59cb694bed454baf2ac97a4
- SSDEEP 12288:fE8O7Y/Zf8O7Y/Zk8O7Y/ZK8O7Y/ZE8O7Y/ZitBEAK:flQFHl2jK
- TLSH
  T173C402B3F3EE801CCA4E9E3780E96FF817A521A441017A937665E0BE5D3357CB2AB115
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion anubis infostealer persistence trojan
- Anubis banker
  Android banker that uses overlays.
  banker trojan infostealer anubis
- Anubis family
  anubis
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Requests enabling of the accessibility settings.
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral8
- Target
  chinese_locker.apk
- Size 43KB
- SHA256 b914c0dd57ffcb1c96cf37d61a3ae052a5372f01c5fac3ea0535bbdb0da862dd
- MD5 735b4e78b334f6b9eb19e700a4c30966
- SHA1 7992ec8c5667c6a47b4e7dd4c5f9b6f12e6b97a4
- SHA512 d28b971b0e928025bc7afdbb12c4e9c018a02af84aaf0b371ac6d548e1d9c445bfd87ed568bccea2b6b273642a2e46ecfe5dc2d80f48572da8224af5826749d4
- SSDEEP 768:Rfg/ORtwWLCZe3/zUcZMSDhd+Vzp412AbUWa51hVsM1k6d8wulj+:RVRtwQCZ8/Bh+14wAbfaFVs0k6dEA
- TLSH
  T1AD13022355C34E49FB3F6075618E50A2E4B8D27F27380A772E52B115128BB907BC6C3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  com.AngryNeighbor.apk
- Size 2.1MB
- SHA256 aa1e1279acf66f8e346444bbe0e669482ebd6cbc2711f8b68ca004f2394c8487
- MD5 b9f8aef5df7170e227834dd2c5a60010
- SHA1 e049e0e78cf31799ecfb98c4d6cc5716b869a894
- SHA512 a6ab6b75e3b13755a782a3dd506dfceef0270c7e0c907acf05427f7788f794eaa6be2df33b87f04063efc24397c247825e01a03019f82c840ded6f86730d2cf1
- SSDEEP 49152:FFTKbolEn0b4rWBQrutb5AZI/crY1knwy:FFkGFsSBQrW9ArGknwy
- TLSH
  T1ADA533839228C964E97F67F10979CD89DD435F10E387A627566CF2F03732CB08E6AA05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  com.crazyapps.angry.birds.multi.user.apk
- Size 40KB
- SHA256 23e1c7389fe32e8df9bcacc70d4df0986901ccfbe4c9625bca42e47700972601
- MD5 cded36f89a6881a47ec70ed2e4ffc93a
- SHA1 e8e171e053c83e628041c7d57059e040da13fa0e
- SHA512 ede089b7173fd6b6cc47e92dcce2097efdb81765a062720e6214c8d585bac18f7ec3386436ae3ff1a9ed7ae51bcc502ab71c11a24ac1fcc8e63399e0037748d8
- SSDEEP 768:Pt5CN2dPTJkHb1hh4wlzoyprZ1XljbI4FDqSoOzg3NxYxBdmyc1BFY:WN2JT8JhNlcypV1XlvPDoag9K/dfcpY
- TLSH
  T1CC13F123EF146EAAD1E4D57B9B2ADC16471B838CC82A71753FA306847F5C23136859C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
behavioral11
- Target
  com.my.kfckfcgrrgihhk.apk
- Size 449KB
- SHA256 490f00aa6fd7dead3c95fc9d7ff2ef995bdca0a0fe1bdd341f7c5fc1ba71f875
- MD5 dd6d76c2fd1177464192372692d7122a
- SHA1 746cb38a725ab07f9d1c16c38add6624e24bd687
- SHA512 f5011b14979eaf77cc9693c092d3564e9b30fdb0a9187e68a4c1ba4946e292094836cf28e4f028b62279de7cc3e620434d5206d6ff3dc452618ee003ecfea389
- SSDEEP 12288:0TjqNlv7CMNpB5ImqAaHAa8AaxAayAa3hN4apqye:0shNTOv9O7gb0Z
- TLSH
  T10BA42385BE9C4C3EE5BEA9BA46AC448DDFD1D3C32D4986C249285AD51EC41DB4FF030A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

ransomware
- Changes the wallpaper (common with ransomware activity)
  ransomware
behavioral12