General
- Target 462e131e3b1b3e72f475374496bd6d0067fb271b78d25302f4798764e961e529.apk
- Size 2.2MB
- Sample260502-qtc4aahv4y
- SHA256 462e131e3b1b3e72f475374496bd6d0067fb271b78d25302f4798764e961e529
- MD5 e143e7e9c6518566b164d17779aeaced
- SHA1 eb5c102409f45d8e3e0c137f5d3f21aed5cc2032
- SHA512 de05f5a053a3b1d445b8e28790a222e27c2cb48e6affdc5a353a76657c0abe5362f8862f5553d226257cf5d369ec3e6dfe4ac02f69b3695a74f5b6ea068bba36
- SSDEEP 49152:3bXariYd8Zkxqm3VSd63y8ZipwkHkB1seN0ELOcnDRoG6MnPhbe:LXaOfZkB3VSdKiikuOcnDClMo
- TLSH T12CB5333B4B00C9DADD6B8B70C2555BB2A48F15544B5EBEC69F4F222C19A36D0A358FF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
462e131e3b1b3e72f475374496bd6d0067fb271b78d25302f4798764e961e529.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Extracted
-
anubis
-
http://ktosdelaetskrintotpidor.com
-
http://sositehuypidarasi.com
Targets
-
- Target 462e131e3b1b3e72f475374496bd6d0067fb271b78d25302f4798764e961e529.apk
- Size 2.2MB
- SHA256 462e131e3b1b3e72f475374496bd6d0067fb271b78d25302f4798764e961e529
- MD5 e143e7e9c6518566b164d17779aeaced
- SHA1 eb5c102409f45d8e3e0c137f5d3f21aed5cc2032
- SHA512 de05f5a053a3b1d445b8e28790a222e27c2cb48e6affdc5a353a76657c0abe5362f8862f5553d226257cf5d369ec3e6dfe4ac02f69b3695a74f5b6ea068bba36
- SSDEEP 49152:3bXariYd8Zkxqm3VSd63y8ZipwkHkB1seN0ELOcnDRoG6MnPhbe:LXaOfZkB3VSdKiikuOcnDClMo
- TLSH T12CB5333B4B00C9DADD6B8B70C2555BB2A48F15544B5EBEC69F4F222C19A36D0A358FF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Anubis payload
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
Acquires the wake lock
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
Requests accessing notifications (often used to intercept notifications before users become aware).
Requests disabling of battery optimizations (often used to enable hiding in the background).
Requests enabling of the accessibility settings.
Listens for changes in the sensor environment (might be used to detect emulation)
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1