Resubmissions

16/07/2026, 15:45

260716-s69zwsgv6q10

16/07/2026, 05:54

260716-glzsmshv7s10

07/07/2026, 07:31

260707-jcfphscw3y10

05/07/2026, 18:06

260705-wpygbaew8s10

04/07/2026, 14:03

260704-rcvgnsbz2l10

04/07/2026, 13:50

260704-q5a33aby4n10

Analysis

  • user interaction
    yes
  • max time kernel
    17s
  • max time network
    153s
  • platform
    android-10_x64
  • resource
    android-x64-20260325-en
  • resource tags

    arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
  • submitted
    05/07/2026, 18:06

General

  • Target
    0803711244BF3AB0B36A0993D640691BE059A8BF407070834BFB427396CBB600.apk
  • Size 2.6MB
  • Sample260705-wpygbaew8s
  • SHA256 0803711244bf3ab0b36a0993d640691be059a8bf407070834bfb427396cbb600
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • anubis

C2
  • http://ktosdelaetskrintotpidord.com

  • http://lastknight.xyz/

  • http://sositehuypidarassi.com

Attributes
  • target_apps

    MyING.be

    aib.ibank.android

    alior.bankingapp.android

    at.easybank.securityapp

    at.psa.app.bawag

    at.spardat.bcrmobile

    at.spardat.netbanking

    au.com.bankwest.mobile

    au.com.cua.mb

    au.com.mebank.banking

    au.com.nab.mobile

    au.com.newcastlepermanent

    au.com.suncorp.SuncorpBank

    ccom.tmob.denizbank

    com.DijitalSahne.EnYakinHalkbank

    com.FubonMobileClient

    com.MobileTreeApp

    com.Plus500

    com.abnamro.nl.mobile.payments

    com.advantage.RaiffeisenBank

    com.aff.otpdirekt

    com.amazon.windowshop

    com.att.myWireless

    com.axis.mobile

    com.bankaustria.android.olb

    com.bankia.wallet

    com.bankinter.launcher

    com.bankofamerica.cashpromobile

    com.bankofqueensland.boq

    com.barclays.android.barclaysmobilebanking

Extracted

Family
  • anubis

C2
  • http://ktosdelaetskrintotpidord.com

  • http://sositehuypidarassi.com

Signatures

  • Family: Anubis banker

    Android banker that uses overlays.

  • Anubis payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

Processes

  • jzjoeyec.jickdalgdphbbgfwwsqq.mdleckaegyywxzxol
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:5023

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Hw.json

        • Path /data/data/jzjoeyec.jickdalgdphbbgfwwsqq.mdleckaegyywxzxol/app_DynamicOptDex/Hw.json
        • Size 1.0MB
        • SHA256 c7b9d30a2b30e0094d31d4cf8e7dd792c0a05596f63289315172ecfc7ef56655
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Hw.json

        • Path /data/data/jzjoeyec.jickdalgdphbbgfwwsqq.mdleckaegyywxzxol/app_DynamicOptDex/Hw.json
        • Size 1.0MB
        • SHA256 cd19116835c30e72c2962d5927cfe90a3b969fec6adb73745e9e915f2dbe4c1f
        • MD5 SHA1 SHA512 SSDEEP TLSH