anubis | 0134530694436b0d7f9d0e750191f53fa902425c07af8797d3f82491fef36714

General

Target
0134530694436b0d7f9d0e750191f53fa902425c07af8797d3f82491fef36714.apk
Size 4.3MB
Sample260721-mkcvdaex7w
SHA256 0134530694436b0d7f9d0e750191f53fa902425c07af8797d3f82491fef36714
MD5 393f959fdd690ad1cf559f66f34516c0
SHA1 500cba289929ab4f203bf35b923641c20457390a
SHA512 2ff1b638e972fc16d9db7013fe296ccf5dffc50c1f1a9f1f9552763c9afcc98b80e61ad2a81a71349d832b495e0ce4077ee5aed48dd9babfa1afde5b727fd46e
SSDEEP 49152:lgtdOcghjfo8rMJ/xQv/wUitROYsnkcF9A9VRsEhc+DEhH6dzR+83yAZvcaKUM9g:07ghk861R5snnA9JhDECRnlZvbKb6kK
TLSH
T1C526CE4EF7547BD9C8B683392C31DEA5111B9C638F478283A8503238DE77BEC5E59988
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

anubis

C2

http://ktosdelaetskrintotpidor.com
http://sositehuypidarasi.com

Attributes

target_apps
MyING.be

aib.ibank.android

alior.bankingapp.android

at.easybank.securityapp

at.psa.app.bawag

at.spardat.bcrmobile

at.spardat.netbanking

au.com.bankwest.mobile

au.com.cua.mb

au.com.mebank.banking

au.com.nab.mobile

au.com.newcastlepermanent

au.com.suncorp.SuncorpBank

ccom.tmob.denizbank

com.DijitalSahne.EnYakinHalkbank

com.FubonMobileClient

com.MobileTreeApp

com.Plus500

com.abnamro.nl.mobile.payments

com.advantage.RaiffeisenBank

com.aff.otpdirekt

com.amazon.windowshop

com.att.myWireless

com.axis.mobile

com.bankaustria.android.olb

com.bankia.wallet

com.bankinter.launcher

com.bankofamerica.cashpromobile

com.bankofqueensland.boq

com.barclays.android.barclaysmobilebanking

com.barclays.ke.mobile.android.ui

com.bbnt

com.bbva.bbvawallet

com.bbva.netcash

com.binance.dev

com.binance.odapplications

com.bitcoin.ss.zebpayindia

com.bitfinex.bfxapp

com.bitmarket.trader

com.bitmarket.trader

com.blockfolio.blockfolio

com.bmo.mobile

com.boursorama.android.clients

com.bssys.vtb.mobileclient

com.btcturk

com.btcturk

com.caisseepargne.android.mobilebanking

com.cba.android.netbank

com.chase.sig.android

com.cibc.android.mobi

com.citi.citimobile

com.clairmail.fth

com.cleverlance.csas.servis24

com.cm_prod.nosactus

com.coin.profit

com.coinbase.android

com.coins.bit.local

com.coins.ful.bit

com.comarch.mobile.banking.bgzbnpparibas.biznes

com.comarch.security.mobilebanking

com.crypter.cryptocyrrency

com.csam.icici.bank.imobile

com.csg.cs.dnmbs

com.db.mm.deutschebank

com.db.mm.norisbank

com.db.pwcc.dbmobile

com.dbs.hk.dbsmbanking

com.de.dkb.portalapp

com.discoverfinancial.mobile

com.eastwest.mobile

com.ebay.mobile

com.edsoftapps.mycoinsvalue

com.empik.empikapp

com.empik.empikfoto

com.fi6122.godough

com.fi6256.godough

com.fi6543.godough

com.fi6665.godough

com.fi9228.godough

com.fi9908.godough

com.finansbank.mobile.cepsube

com.finanteq.finance.ca

com.fragment.akbank

com.fuib.android.spot.online

com.fusion.ATMLocator

com.garantiyatirim.fx

com.getingroup.mobilebanking

com.grppl.android.shell.BOS

com.grppl.android.shell.CMBlloydsTSB73

com.grppl.android.shell.halifax

com.hangseng.rbmobile

com.htsu.hsbcpersonalbanking

com.idbi.mpassbook

com.ideomobile.hapoalim

com.ifs.banking.fiid1369

com.ifs.mobilebanking.fiid3919

com.imb.banking2

com.infrasofttech.indianBank

com.ing.diba.mbbr2

com.ing.mobile

com.ingbanktr.ingmobil

com.isis_papyrus.raiffeisen_pay_eyewdg

com.jackhenry.rockvillebankct

com.jackhenry.washingtontrustbankwa

com.jackpf.blockchainsearch

com.jamalabbasii1998.localbitcoin

com.jiffyondemand.user

com.jpm.sig.android

com.kryptokit.jaxx

com.kutxabank.android

com.kuveytturk.mobil

com.kuveytturk.mobil

com.latuabanca_tabperandroid

com.latuabancaperandroid

com.localbitcoins.exchange

com.localbitcoinsmbapp

com.lynxspa.bancopopolare

com.magiclick.odeabank

com.magiclick.odeabank

com.mal.saul.coinmarketcap

com.matriksdata.ziraatyatirim.pad

com.mobikwik_new

com.mobillium.papara

com.mobillium.papara

com.moneybookers.skrillpayments

com.moneybookers.skrillpayments.neteller

com.monitise.isbankmoscow

com.mtel.androidbea

com.mycelium.wallet

com.orangefinansek

com.oxigen.oxigenwallet

com.palatine.android.mobilebanking.prod

com.paypal.android.p2pmobile

com.plunien.poloniex

com.portfolio.coinbase_tracker

com.pozitron.albarakaturk

com.pozitron.albarakaturk

com.pozitron.iscep

com.pozitron.vakifbank

com.quickmobile.anzirevents15

com.rbc.mobile.android

com.rbs.mobile.android.natwestbandc

com.rbs.mobile.android.rbsbandc

com.rbs.mobile.android.ubr

com.redrockdigimark

com.rsi

com.santander.app

com.sbi.SBIFreedomPlus

com.scb.breezebanking.hk

com.scotiabank.mobile

com.snapwork.hdfc

com.sovereign.santander

com.starfinanz.smob.android.sbanking

com.starfinanz.smob.android.sfinanzstatus.tablet

com.sterling.onepay

com.suntrust.mobilebanking

com.svb.mobilebanking

com.targo_prod.bad

com.td

com.teb

com.teb

com.tecnocom.cajalaboral

com.thunkable.android.manirana54.LocalBitCoins

com.thunkable.android.manirana54.LocalBitCoins_unblock

com.thunkable.android.santoshmehta364.UNOCOIN_LIVE

com.tmob.denizbank

com.tmob.tabletdeniz

com.tnx.apps.coinportfolio

com.triodos.bankingnl

com.ukrsibbank.client.android

com.unicredit

com.unionbank.ecommerce.mobile.commercial.legacy

com.unionbank.ecommerce.mobile.commercial.legacy

com.unocoin.unocoinmerchantPoS

com.unocoin.unocoinwallet

com.usaa.mobile.android.usaa

com.usbank.mobilebanking

com.vakifbank.mobilel

com.veripark.ykbaz

com.vzw.hss.myverizon

com.wellsFargo.ceomobile

com.yinzcam.facilities.verizon

com.ykb.android

cz.airbank.android

cz.csob.smartbanking

cz.sberbankcz

de.comdirect.android

de.commerzbanking.mobil

de.consorsbank

de.fiducia.smartphone.android.banking.vr

de.postbank.finanzassistent

de.schildbach.wallet

es.bancopopular.nbmpopular

es.evobanco.bancamovil

es.lacaixa.mobile.android.newwapicon

eu.eleader.mobilebanking.invest

eu.eleader.mobilebanking.pekao

eu.eleader.mobilebanking.pekao.firm

eu.eleader.mobilebanking.raiffeisen

eu.inmite.prj.kb.mobilbank

eu.unicreditgroup.hvbapptan

finansbank.enpara

fr.axa.monaxa

fr.banquepopulaire.cyberplus

fr.creditagricole.androidapp

fr.laposte.lapostetablet

fr.lcl.android.customerarea

hdfcbank.hdfcquickbank

hk.com.hsbc.hsbchkmobilebanking

hr.asseco.android.jimba.mUCI.ro

in.co.bankofbaroda.mpassbook

info.blockchain.merchant

io.getdelta.android

it.bnl.apps.banking

it.bnl.apps.enterprise.bnlpay

it.bpc.proconl.mbplus

it.copergmps.rt.pf.android.sp.bmps

it.gruppocariparma.nowbanking

it.ingdirect.app

it.nogood.container

it.popso.SCRIGNOapp

jp.co.aeonbank.android.passbook

jp.co.netbk

jp.co.rakuten_bank.rakutenbank

jp.co.sevenbank.AppPassbook

jp.co.smbc.direct

jp.mufg.bk.applisp.app

may.maybank.android

me.doubledutch.hvdnz.cbnationalconference2016

mobi.societegenerale.mobile.lappli

mobile.santander.de

net.bnpparibas.mescomptes

nl.asnbank.asnbankieren

nl.snsbank.mobielbetalen

nz.co.anz.android.mobilebanking

nz.co.asb.asbmobile

nz.co.bnz.droidbanking

nz.co.kiwibank.mobile

nz.co.westpac

org.banksa.bank

org.bom.bank

org.stgeorge.bank

org.usemployees.mobile

pinacleMobileiPhoneApp.android

piuk.blockchain.android

pl.aliorbank.aib

pl.allegro

pl.bosbank.mobile

pl.bph

pl.bps.bankowoscmobilna

pl.bzwbk.bzwbk24

pl.bzwbk.ibiznes24

pl.bzwbk.mobile.tab.bzwbk24

pl.ceneo

pl.com.rossmann.centauros

pl.fmbank.smart

pl.ideabank.mobilebanking

pl.ing.mojeing

pl.ipko.mobile

pl.mbank

pl.millennium.corpApp

pl.orange.mojeorange

pl.pkobp.iko

pl.pkobp.ipkobiznes

posteitaliane.posteapp.apppostepay

ro.btrl.mobile

ru.alfabank.mobile.ua.android

ru.alfadirect.app

ru.mw

ru.sberbank.sberbankir

ru.tinkoff.goabroad

sk.sporoapps.skener

tr.com.hsbc.hsbcturkey

tr.com.sekerbilisim.mbank

tr.com.sekerbilisim.mbank

ua.aval.dbo.client.android

ua.com.cs.ifobs.mobile.android.otp

ua.com.cs.ifobs.mobile.android.pivd

ua.oschadbank.online

ua.privatbank.ap24

wit.android.bcpBankingApp.millenniumPL

wos.com.zebpay

zebpay.Application

Extracted

Family

anubis

C2

http://ktosdelaetskrintotpidor.com
http://sositehuypidarasi.com

Targets

- Target
  0134530694436b0d7f9d0e750191f53fa902425c07af8797d3f82491fef36714.apk
- Size 4.3MB
- SHA256 0134530694436b0d7f9d0e750191f53fa902425c07af8797d3f82491fef36714
- MD5 393f959fdd690ad1cf559f66f34516c0
- SHA1 500cba289929ab4f203bf35b923641c20457390a
- SHA512 2ff1b638e972fc16d9db7013fe296ccf5dffc50c1f1a9f1f9552763c9afcc98b80e61ad2a81a71349d832b495e0ce4077ee5aed48dd9babfa1afde5b727fd46e
- SSDEEP 49152:lgtdOcghjfo8rMJ/xQv/wUitROYsnkcF9A9VRsEhc+DEhH6dzR+83yAZvcaKUM9g:07ghk861R5snnA9JhDECRnlZvbKb6kK
- TLSH
  T1C526CE4EF7547BD9C8B683392C31DEA5111B9C638F478283A8503238DE77BEC5E59988
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution anubis knspy infostealer persistence spyware stealth trojan cometbot
- Android KnSpy payload
- Anubis payload
- Family: Anubis banker
  Android banker that uses overlays.
  banker trojan infostealer anubis
- Family: CometBot
  CometBot is an Android banking trojan first seen in 2019.
  trojan infostealer banker cometbot
- Family: KnSpy
  KnSpy is an Android spyware linked to Donot team.
  spyware trojan infostealer knspy
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the calendar entry data.
  collection
- Reads the content of the call log.
  collection
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery defense_evasion
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral1 behavioral2 behavioral3 behavioral4