General
- Target 0803711244BF3AB0B36A0993D640691BE059A8BF407070834BFB427396CBB600.apk
- Size 2.6MB
- Sample260705-wpygbaew8s
- SHA256 0803711244bf3ab0b36a0993d640691be059a8bf407070834bfb427396cbb600
- MD5 201aa553f5c98b69c975ab2e58704dce
- SHA1 47a77bede86f2227491876a6dc8719fecd2c12fe
- SHA512 cb08c024559862879182bbafcdb97c3a6e54ffa1d65b7948041f81b1b8327502035bbceb79806082c67ed970dc63cbfb37ba065c39e659041aaf6e5d37d5a93c
- SSDEEP 49152:RHujuipahHvN+4cNWOyUTFkhkr9uC7KjZcEk0p2w+I1KAvyOTEDC1e/gEFtyMR:d8ukaD9kgcT0p3+I1ZE+NEFtyMR
- TLSH T15FC533776E2A7952D03FC9FAB5C51A023F5EE25C2871F8DB253102419B42A9EDF07A0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
0803711244BF3AB0B36A0993D640691BE059A8BF407070834BFB427396CBB600.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
0803711244BF3AB0B36A0993D640691BE059A8BF407070834BFB427396CBB600.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
0803711244BF3AB0B36A0993D640691BE059A8BF407070834BFB427396CBB600.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Extracted
-
anubis
-
http://ktosdelaetskrintotpidord.com
-
http://lastknight.xyz/
-
http://sositehuypidarassi.com
-
target_apps
MyING.be
aib.ibank.android
alior.bankingapp.android
at.easybank.securityapp
at.psa.app.bawag
at.spardat.bcrmobile
at.spardat.netbanking
au.com.bankwest.mobile
au.com.cua.mb
au.com.mebank.banking
au.com.nab.mobile
au.com.newcastlepermanent
au.com.suncorp.SuncorpBank
ccom.tmob.denizbank
com.DijitalSahne.EnYakinHalkbank
com.FubonMobileClient
com.MobileTreeApp
com.Plus500
com.abnamro.nl.mobile.payments
com.advantage.RaiffeisenBank
com.aff.otpdirekt
com.amazon.windowshop
com.att.myWireless
com.axis.mobile
com.bankaustria.android.olb
com.bankia.wallet
com.bankinter.launcher
com.bankofamerica.cashpromobile
com.bankofqueensland.boq
com.barclays.android.barclaysmobilebanking
com.barclays.ke.mobile.android.ui
com.bbnt
com.bbva.bbvawallet
com.bbva.netcash
com.binance.dev
com.binance.odapplications
com.bitcoin.ss.zebpayindia
com.bitfinex.bfxapp
com.bitmarket.trader
com.bitmarket.trader
com.blockfolio.blockfolio
com.bmo.mobile
com.boursorama.android.clients
com.bssys.vtb.mobileclient
com.btcturk
com.btcturk
com.caisseepargne.android.mobilebanking
com.cba.android.netbank
com.chase.sig.android
com.cibc.android.mobi
com.citi.citimobile
com.clairmail.fth
com.cleverlance.csas.servis24
com.cm_prod.nosactus
com.coin.profit
com.coinbase.android
com.coins.bit.local
com.coins.ful.bit
com.comarch.mobile.banking.bgzbnpparibas.biznes
com.comarch.security.mobilebanking
com.crypter.cryptocyrrency
com.csam.icici.bank.imobile
com.csg.cs.dnmbs
com.db.mm.deutschebank
com.db.mm.norisbank
com.db.pwcc.dbmobile
com.dbs.hk.dbsmbanking
com.de.dkb.portalapp
com.discoverfinancial.mobile
com.eastwest.mobile
com.ebay.mobile
com.edsoftapps.mycoinsvalue
com.empik.empikapp
com.empik.empikfoto
com.fi6122.godough
com.fi6256.godough
com.fi6543.godough
com.fi6665.godough
com.fi9228.godough
com.fi9908.godough
com.finansbank.mobile.cepsube
com.finanteq.finance.ca
com.fragment.akbank
com.fuib.android.spot.online
com.fusion.ATMLocator
com.garantiyatirim.fx
com.getingroup.mobilebanking
com.grppl.android.shell.BOS
com.grppl.android.shell.CMBlloydsTSB73
com.grppl.android.shell.halifax
com.hangseng.rbmobile
com.htsu.hsbcpersonalbanking
com.idbi.mpassbook
com.ideomobile.hapoalim
com.ifs.banking.fiid1369
com.ifs.mobilebanking.fiid3919
com.imb.banking2
com.infrasofttech.indianBank
com.ing.diba.mbbr2
com.ing.mobile
com.ingbanktr.ingmobil
com.isis_papyrus.raiffeisen_pay_eyewdg
com.jackhenry.rockvillebankct
com.jackhenry.washingtontrustbankwa
com.jackpf.blockchainsearch
com.jamalabbasii1998.localbitcoin
com.jiffyondemand.user
com.jpm.sig.android
com.kryptokit.jaxx
com.kutxabank.android
com.kuveytturk.mobil
com.kuveytturk.mobil
com.latuabanca_tabperandroid
com.latuabancaperandroid
com.localbitcoins.exchange
com.localbitcoinsmbapp
com.lynxspa.bancopopolare
com.magiclick.odeabank
com.magiclick.odeabank
com.mal.saul.coinmarketcap
com.matriksdata.ziraatyatirim.pad
com.mobikwik_new
com.mobillium.papara
com.mobillium.papara
com.moneybookers.skrillpayments
com.moneybookers.skrillpayments.neteller
com.monitise.isbankmoscow
com.mtel.androidbea
com.mycelium.wallet
com.orangefinansek
com.oxigen.oxigenwallet
com.palatine.android.mobilebanking.prod
com.paypal.android.p2pmobile
com.plunien.poloniex
com.portfolio.coinbase_tracker
com.pozitron.albarakaturk
com.pozitron.albarakaturk
com.pozitron.iscep
com.pozitron.vakifbank
com.quickmobile.anzirevents15
com.rbc.mobile.android
com.rbs.mobile.android.natwestbandc
com.rbs.mobile.android.rbsbandc
com.rbs.mobile.android.ubr
com.redrockdigimark
com.rsi
com.santander.app
com.sbi.SBIFreedomPlus
com.scb.breezebanking.hk
com.scotiabank.mobile
com.snapwork.hdfc
com.sovereign.santander
com.starfinanz.smob.android.sbanking
com.starfinanz.smob.android.sfinanzstatus.tablet
com.sterling.onepay
com.suntrust.mobilebanking
com.svb.mobilebanking
com.targo_prod.bad
com.td
com.teb
com.teb
com.tecnocom.cajalaboral
com.thunkable.android.manirana54.LocalBitCoins
com.thunkable.android.manirana54.LocalBitCoins_unblock
com.thunkable.android.santoshmehta364.UNOCOIN_LIVE
com.tmob.denizbank
com.tmob.tabletdeniz
com.tnx.apps.coinportfolio
com.triodos.bankingnl
com.ukrsibbank.client.android
com.unicredit
com.unionbank.ecommerce.mobile.commercial.legacy
com.unionbank.ecommerce.mobile.commercial.legacy
com.unocoin.unocoinmerchantPoS
com.unocoin.unocoinwallet
com.usaa.mobile.android.usaa
com.usbank.mobilebanking
com.vakifbank.mobilel
com.veripark.ykbaz
com.vzw.hss.myverizon
com.wellsFargo.ceomobile
com.yinzcam.facilities.verizon
com.ykb.android
cz.airbank.android
cz.csob.smartbanking
cz.sberbankcz
de.comdirect.android
de.commerzbanking.mobil
de.consorsbank
de.fiducia.smartphone.android.banking.vr
de.postbank.finanzassistent
de.schildbach.wallet
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
eu.eleader.mobilebanking.invest
eu.eleader.mobilebanking.pekao
eu.eleader.mobilebanking.pekao.firm
eu.eleader.mobilebanking.raiffeisen
eu.inmite.prj.kb.mobilbank
eu.unicreditgroup.hvbapptan
finansbank.enpara
fr.axa.monaxa
fr.banquepopulaire.cyberplus
fr.creditagricole.androidapp
fr.laposte.lapostetablet
fr.lcl.android.customerarea
hdfcbank.hdfcquickbank
hk.com.hsbc.hsbchkmobilebanking
hr.asseco.android.jimba.mUCI.ro
in.co.bankofbaroda.mpassbook
info.blockchain.merchant
io.getdelta.android
it.bnl.apps.banking
it.bnl.apps.enterprise.bnlpay
it.bpc.proconl.mbplus
it.copergmps.rt.pf.android.sp.bmps
it.gruppocariparma.nowbanking
it.ingdirect.app
it.nogood.container
it.popso.SCRIGNOapp
jp.co.aeonbank.android.passbook
jp.co.netbk
jp.co.rakuten_bank.rakutenbank
jp.co.sevenbank.AppPassbook
jp.co.smbc.direct
jp.mufg.bk.applisp.app
may.maybank.android
me.doubledutch.hvdnz.cbnationalconference2016
mobi.societegenerale.mobile.lappli
mobile.santander.de
net.bnpparibas.mescomptes
nl.asnbank.asnbankieren
nl.snsbank.mobielbetalen
nz.co.anz.android.mobilebanking
nz.co.asb.asbmobile
nz.co.bnz.droidbanking
nz.co.kiwibank.mobile
nz.co.westpac
org.banksa.bank
org.bom.bank
org.stgeorge.bank
org.usemployees.mobile
pinacleMobileiPhoneApp.android
piuk.blockchain.android
pl.aliorbank.aib
pl.allegro
pl.bosbank.mobile
pl.bph
pl.bps.bankowoscmobilna
pl.bzwbk.bzwbk24
pl.bzwbk.ibiznes24
pl.bzwbk.mobile.tab.bzwbk24
pl.ceneo
pl.com.rossmann.centauros
pl.fmbank.smart
pl.ideabank.mobilebanking
pl.ing.mojeing
pl.ipko.mobile
pl.mbank
pl.millennium.corpApp
pl.orange.mojeorange
pl.pkobp.iko
pl.pkobp.ipkobiznes
posteitaliane.posteapp.apppostepay
ro.btrl.mobile
ru.alfabank.mobile.ua.android
ru.alfadirect.app
ru.mw
ru.sberbank.sberbankir
ru.tinkoff.goabroad
sk.sporoapps.skener
tr.com.hsbc.hsbcturkey
tr.com.sekerbilisim.mbank
tr.com.sekerbilisim.mbank
ua.aval.dbo.client.android
ua.com.cs.ifobs.mobile.android.otp
ua.com.cs.ifobs.mobile.android.pivd
ua.oschadbank.online
ua.privatbank.ap24
wit.android.bcpBankingApp.millenniumPL
wos.com.zebpay
zebpay.Application
Extracted
-
anubis
-
http://ktosdelaetskrintotpidord.com
-
http://sositehuypidarassi.com
Targets
-
- Target 0803711244BF3AB0B36A0993D640691BE059A8BF407070834BFB427396CBB600.apk
- Size 2.6MB
- SHA256 0803711244bf3ab0b36a0993d640691be059a8bf407070834bfb427396cbb600
- MD5 201aa553f5c98b69c975ab2e58704dce
- SHA1 47a77bede86f2227491876a6dc8719fecd2c12fe
- SHA512 cb08c024559862879182bbafcdb97c3a6e54ffa1d65b7948041f81b1b8327502035bbceb79806082c67ed970dc63cbfb37ba065c39e659041aaf6e5d37d5a93c
- SSDEEP 49152:RHujuipahHvN+4cNWOyUTFkhkr9uC7KjZcEk0p2w+I1KAvyOTEDC1e/gEFtyMR:d8ukaD9kgcT0p3+I1ZE+NEFtyMR
- TLSH T15FC533776E2A7952D03FC9FAB5C51A023F5EE25C2871F8DB253102419B42A9EDF07A0D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Anubis payload
-
Family: CometBot
CometBot is an Android banking trojan first seen in 2019.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries the phone number (MSISDN for GSM devices)
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Requests enabling of the accessibility settings.
-
Listens for changes in the sensor environment (might be used to detect emulation)