Analysis

  • user interaction
    yes
  • max time kernel
    43s
  • max time network
    151s
  • platform
    android-14_x64
  • resource
    android-34-x64-arm64-20260325.1-en
  • resource tags

    arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
  • submitted
    21/07/2026, 10:31

General

  • Target
    0134530694436b0d7f9d0e750191f53fa902425c07af8797d3f82491fef36714.apk
  • Size 4.3MB
  • Sample260721-mkcvdaex7w
  • SHA256 0134530694436b0d7f9d0e750191f53fa902425c07af8797d3f82491fef36714
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • anubis

C2
  • http://ktosdelaetskrintotpidor.com

  • http://sositehuypidarasi.com

Attributes
  • target_apps

    MyING.be

    aib.ibank.android

    alior.bankingapp.android

    at.easybank.securityapp

    at.psa.app.bawag

    at.spardat.bcrmobile

    at.spardat.netbanking

    au.com.bankwest.mobile

    au.com.cua.mb

    au.com.mebank.banking

    au.com.nab.mobile

    au.com.newcastlepermanent

    au.com.suncorp.SuncorpBank

    ccom.tmob.denizbank

    com.DijitalSahne.EnYakinHalkbank

    com.FubonMobileClient

    com.MobileTreeApp

    com.Plus500

    com.abnamro.nl.mobile.payments

    com.advantage.RaiffeisenBank

    com.aff.otpdirekt

    com.amazon.windowshop

    com.att.myWireless

    com.axis.mobile

    com.bankaustria.android.olb

    com.bankia.wallet

    com.bankinter.launcher

    com.bankofamerica.cashpromobile

    com.bankofqueensland.boq

    com.barclays.android.barclaysmobilebanking

Extracted

Family
  • anubis

C2
  • http://ktosdelaetskrintotpidor.com

  • http://sositehuypidarasi.com

Signatures

  • Family: Anubis banker

    Android banker that uses overlays.

  • Family: CometBot

    CometBot is an Android banking trojan first seen in 2019.

  • Family: KnSpy

    KnSpy is an Android spyware linked to Donot team.

  • Android KnSpy payload 1 IoCs
  • Anubis payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 59 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
  • Reads the content of the calendar entry data. 1 TTPs 1 IoCs
  • Reads the content of the call log. 1 TTPs 1 IoCs
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.tencent.mm
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries account information for other applications stored on the device
    • Reads the contacts stored on the device.
    • Reads the content of the calendar entry data.
    • Reads the content of the call log.
    • Requests cell location
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Schedules tasks to execute at a specified time
    PID:4607

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        framework-adservices.jar

        • Path /apex/com.android.adservices/javalib/framework-adservices.jar
        • Size 326KB
        • SHA256 c1a4b59ea8d2fc38cccee7f0fb32521c8fb2116b3a01818467b7710c5bf86d25
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-sdksandbox.jar

        • Path /apex/com.android.adservices/javalib/framework-sdksandbox.jar
        • Size 64KB
        • SHA256 842233dd46f31abddaa1fdf001699860e08b3697c1eeb3bfa8d3cd51c97f01b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-appsearch.jar

        • Path /apex/com.android.appsearch/javalib/framework-appsearch.jar
        • Size 169KB
        • SHA256 daef8bd66a572bd090ec1a81f887c2819b04d5d521948a6d489cefff5447fd4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apache-xml.jar

        • Path /apex/com.android.art/javalib/apache-xml.jar
        • Size 1.1MB
        • SHA256 72fa596bcafba7f2558124f80e350f70a28eb2e32b95e7bbdb7decae60899954
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bouncycastle.jar

        • Path /apex/com.android.art/javalib/bouncycastle.jar
        • Size 1.4MB
        • SHA256 bfa6f6e81b5f36c50b06bd9db33398f111ee90a43c9f1c1088a6eaea386d67ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        core-libart.jar

        • Path /apex/com.android.art/javalib/core-libart.jar
        • Size 558KB
        • SHA256 f8446de0652007eccd8ef142f772aba8df7c728d07b7f66319af5cf9ab1dc646
        • MD5 SHA1 SHA512 SSDEEP TLSH

        core-oj.jar

        • Path /apex/com.android.art/javalib/core-oj.jar
        • Size 5.3MB
        • SHA256 26f2a49dffe39e31bf24520d07802e1409526c0ebecf6426d447f8fa3101e9a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        okhttp.jar

        • Path /apex/com.android.art/javalib/okhttp.jar
        • Size 395KB
        • SHA256 f6365c62b8b92ad4d9860f0c480e567cb5b9aeaaae21994f939bbe0b8d1e3d1b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-bluetooth.jar

        • Path /apex/com.android.btservices/javalib/framework-bluetooth.jar
        • Size 1.1MB
        • SHA256 910aed1aa1a636a17790c6ff6e3bcd3acf8b162deead4da34b68002279f0a18e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-configinfrastructure.jar

        • Path /apex/com.android.configinfrastructure/javalib/framework-configinfrastructure.jar
        • Size 137KB
        • SHA256 7bff466a8417cb8690791ac9dffa8d5d23ca57fdb42aa7d22481b87449ba74db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        conscrypt.jar

        • Path /apex/com.android.conscrypt/javalib/conscrypt.jar
        • Size 455KB
        • SHA256 51e9b229e1e536b932558ba7f14a8d6033879acfce32a0a79e93d3c2519203b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-devicelock.jar

        • Path /apex/com.android.devicelock/javalib/framework-devicelock.jar
        • Size 26KB
        • SHA256 94928a87282a5a2375ed472291460af08c7af156497a3e80e7c72a90bf4102c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-healthfitness.jar

        • Path /apex/com.android.healthfitness/javalib/framework-healthfitness.jar
        • Size 509KB
        • SHA256 0b43f811dcfb0ebb50d0b481d6d270b96c623e3eb942773a71f67c6f8461765f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        core-icu4j.jar

        • Path /apex/com.android.i18n/javalib/core-icu4j.jar
        • Size 2.8MB
        • SHA256 ca57085a574661788d93d614a2fb4c8193e2a3bd11181fde7739e360cad3005f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        android.net.ipsec.ike.jar

        • Path /apex/com.android.ipsec/javalib/android.net.ipsec.ike.jar
        • Size 683KB
        • SHA256 e53a3fb4bedad85ceedd41eb4500ceda0679a36125ca7091620e08a07ed09481
        • MD5 SHA1 SHA512 SSDEEP TLSH

        updatable-media.jar

        • Path /apex/com.android.media/javalib/updatable-media.jar
        • Size 747KB
        • SHA256 3a95a47f87da082da5cd87caac80569853a34988cdc4c2f19565245233af9ec6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-mediaprovider.jar

        • Path /apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar
        • Size 76KB
        • SHA256 fb0bc659e1744a0bb75d60e809258ffffc3652e2fd38662aaa32ef514199f660
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-ondevicepersonalization.jar

        • Path /apex/com.android.ondevicepersonalization/javalib/framework-ondevicepersonalization.jar
        • Size 178KB
        • SHA256 61871aa107958d9c2f7cb949c6a1c09198273a265c5cdc83849435c61cf324b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-statsd.jar

        • Path /apex/com.android.os.statsd/javalib/framework-statsd.jar
        • Size 94KB
        • SHA256 11193f65a235bb7f03682bbf6cc6e3da73c92d977e0a36f452a95a469cf0484c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-permission-s.jar

        • Path /apex/com.android.permission/javalib/framework-permission-s.jar
        • Size 207KB
        • SHA256 753f557b1e79af71fde3cfa80342642dada1665c8b42f7a340b1ea05210d9dc0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-permission.jar

        • Path /apex/com.android.permission/javalib/framework-permission.jar
        • Size 608B
        • SHA256 34dfd75d140b601d1617346e628d35d0ffe3e9c57e41449001ef3529d2cde4eb
        • MD5 SHA1 SHA512 TLSH

        framework-scheduling.jar

        • Path /apex/com.android.scheduling/javalib/framework-scheduling.jar
        • Size 12KB
        • SHA256 a5ad3f8db021142a8ba5666e4bc29fd163f553364ae5c30d9e660dd97cb31074
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-sdkextensions.jar

        • Path /apex/com.android.sdkext/javalib/framework-sdkextensions.jar
        • Size 6KB
        • SHA256 e73f45edf54bcf93ffa20f70776cd2ddc9c853766e2e87c0f40dc9d8e05825b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-connectivity-t.jar

        • Path /apex/com.android.tethering/javalib/framework-connectivity-t.jar
        • Size 392KB
        • SHA256 c725432d7e6084c8fc93473dafd3cbf1ad533bd9c67ccec441c767f2944941d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-connectivity.jar

        • Path /apex/com.android.tethering/javalib/framework-connectivity.jar
        • Size 1.6MB
        • SHA256 c1cb8d0bfd1177aa7abad79af9e8cb5de7f39005a37bb8b29e23da3f4167acc5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-tethering.jar

        • Path /apex/com.android.tethering/javalib/framework-tethering.jar
        • Size 67KB
        • SHA256 e5af73c493d50ff6de72cf2bf70c2eec42c8642ac990bb043d1ee7f06a287421
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-uwb.jar

        • Path /apex/com.android.uwb/javalib/framework-uwb.jar
        • Size 134KB
        • SHA256 dede2e234f1d5493522c2f922083ab066843f527160bad9aefff2b8cf42e7592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-virtualization.jar

        • Path /apex/com.android.virt/javalib/framework-virtualization.jar
        • Size 78KB
        • SHA256 2fbde57fd13dc3c630bf476c4992e98942cf841c8f69f358ad0a8b2a89e8230d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        framework-wifi.jar

        • Path /apex/com.android.wifi/javalib/framework-wifi.jar
        • Size 1.1MB
        • SHA256 aa98e93aefe8e988ac6b929b3b59404fca6b62c4724617975aad4bac29dceb7c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apk.ijiami-v1.pro.so

        • Path /data/user/0/com.tencent.mm/app_mph_dex/apk.ijiami-v1.pro.so
        • Size 7.8MB
        • SHA256 b7ace4bf425d6f1715add5261f7ac368f2b3e1855d3faf38bbee773aef502c4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base.4607.tmp

        • Path /data/user/0/com.tencent.mm/cache/oat_primary/x86_64/base.4607.tmp
        • Size 12KB
        • SHA256 e96611c415377b6677c25b17ee2e6c077ef48a2495dccfbdabad7908952ec3d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Dname

        • Path /data/user/0/com.tencent.mm/databases/Dname
        • Size 32KB
        • SHA256 45bfb277d760e4ae50e45607e97c6fb8567559e3991d598de8c6b0f46cc90574
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Dname-journal

        • Path /data/user/0/com.tencent.mm/databases/Dname-journal
        • Size 512B
        • SHA256 55c7fcd77ce9708de1df66d6a53c1e3132ef1b43dbc4bd5d22ac4bb72e08488c
        • MD5 SHA1 SHA512

        Dname-journal

        • Path /data/user/0/com.tencent.mm/databases/Dname-journal
        • Size 8KB
        • SHA256 687a19507c19e3fec9fd58162fe23016c0acdde60c3fc2f30b67387c0ad19ccb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Dname-journal

        • Path /data/user/0/com.tencent.mm/databases/Dname-journal
        • Size 8KB
        • SHA256 8f6f9297248697bc3d4edc19c954d12858a741c0bc1b1f73ae5270387788b5c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Dname-journal

        • Path /data/user/0/com.tencent.mm/databases/Dname-journal
        • Size 8KB
        • SHA256 776ef87096645513acb5d73f57bda8d764664a2c696d2ddc39646b29ab4ffe9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Dname-journal

        • Path /data/user/0/com.tencent.mm/databases/Dname-journal
        • Size 8KB
        • SHA256 4c71eda7c2bbb57bbc55483209684627f1b7121fc40915bad069115bbfab8125
        • MD5 SHA1 SHA512 SSDEEP TLSH

        evernote_jobs.db

        • Path /data/user/0/com.tencent.mm/databases/evernote_jobs.db
        • Size 16KB
        • SHA256 491f7f117d69d7685cae3c60bf99e7213149f6b5635d19fb66fc34a5962b64a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        evernote_jobs.db-journal

        • Path /data/user/0/com.tencent.mm/databases/evernote_jobs.db-journal
        • Size 512B
        • SHA256 65d795a0477706a309e175336c6476def471d308a1703f0df8bae6a230559afc
        • MD5 SHA1 SHA512

        evernote_jobs.db-journal

        • Path /data/user/0/com.tencent.mm/databases/evernote_jobs.db-journal
        • Size 8KB
        • SHA256 da46a59fde8d54568ef9c97c73a90886200b67d88749d839fe21293d894ee203
        • MD5 SHA1 SHA512 SSDEEP TLSH

        evernote_jobs.db-journal

        • Path /data/user/0/com.tencent.mm/databases/evernote_jobs.db-journal
        • Size 8KB
        • SHA256 0b34c7b778684e09f07bb194fbd4d995517675440bd0fb68c7c134f223e3c084
        • MD5 SHA1 SHA512 SSDEEP TLSH

        evernote_jobs.db-journal

        • Path /data/user/0/com.tencent.mm/databases/evernote_jobs.db-journal
        • Size 8KB
        • SHA256 c01e3ece734a8208b55f1a7e3f9d22ab4136c40b9250151fda879fab2657738d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        evernote_jobs.db-journal

        • Path /data/user/0/com.tencent.mm/databases/evernote_jobs.db-journal
        • Size 8KB
        • SHA256 cea54961cb98940913b544a5841cc2b1879f58ecb0a8abba6399d631232a2386
        • MD5 SHA1 SHA512 SSDEEP TLSH

        evernote_jobs.db-journal

        • Path /data/user/0/com.tencent.mm/databases/evernote_jobs.db-journal
        • Size 8KB
        • SHA256 304dbc76b59fc1531e922b52936f4b4a3765e6b75312499c882ae1e1eb55db5b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CallLogs.txt

        • Path /data/user/0/com.tencent.mm/files/CallLogs.txt
        • Size 3B
        • SHA256 37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570
        • MD5 SHA1 SHA512

        GP.txt

        • Path /data/user/0/com.tencent.mm/files/GP.txt
        • Size 114B
        • SHA256 950300f650e65f3ed9fe100f961da3630d3df1a233fc609068ab31a33fbff59c
        • MD5 SHA1 SHA512 TLSH

        GP.txt

        • Path /data/user/0/com.tencent.mm/files/GP.txt
        • Size 114B
        • SHA256 b33fd6d6930b56b749a266dacc1645c30bb24b291b153daa4b7f0f00607a3031
        • MD5 SHA1 SHA512 TLSH

        GP.txt

        • Path /data/user/0/com.tencent.mm/files/GP.txt
        • Size 116B
        • SHA256 2310f60599654a1317b4ded6c3f9353aec49afda6f8d647459fd2499fd3e8b95
        • MD5 SHA1 SHA512 TLSH

        Tree.txt

        • Path /data/user/0/com.tencent.mm/files/Tree.txt
        • Size 566B
        • SHA256 c94ded86433b46ffb42777e62d610b2fd783014472b43f9a2c2192ce99f8c096
        • MD5 SHA1 SHA512 TLSH

        accounts.txt

        • Path /data/user/0/com.tencent.mm/files/accounts.txt
        • Size 2B
        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
        • MD5 SHA1 SHA512

        netinfo.txt

        • Path /data/user/0/com.tencent.mm/files/netinfo.txt
        • Size 1KB
        • SHA256 15ce39883a285a6a9894e6325880711c88792800fec89a1018ed7886d4f547ec
        • MD5 SHA1 SHA512 TLSH

        pkinfo.txt

        • Path /data/user/0/com.tencent.mm/files/pkinfo.txt
        • Size 12KB
        • SHA256 4ad744dec68ea3fa5f701f913c5fe02d31751a87ef483fb45f9187ac20d4c182
        • MD5 SHA1 SHA512 SSDEEP TLSH

        log-2026-07-21.txt

        • Path /storage/emulated/0/Config/sys/apps/log/log-2026-07-21.txt
        • Size 32B
        • SHA256 4c165b4707438878eed717e80cd981e753bf8e2d5e9abdce5cfd692542006f75
        • MD5 SHA1 SHA512

        log-2026-07-21.txt

        • Path /storage/emulated/0/Config/sys/apps/log/log-2026-07-21.txt
        • Size 24B
        • SHA256 ba606813d6c59c6ecaa8f2ff9ae1c31f9820d1526ded195f90ddf561eef0cb6d
        • MD5 SHA1 SHA512

        log-2026-07-21.txt

        • Path /storage/emulated/0/Config/sys/apps/log/log-2026-07-21.txt
        • Size 299B
        • SHA256 736ff12db2359b62336b62fbe0098a92263279d025a3fe62ed42cee562112ab2
        • MD5 SHA1 SHA512 TLSH

        log-2026-07-21.txt

        • Path /storage/emulated/0/Config/sys/apps/log/log-2026-07-21.txt
        • Size 12B
        • SHA256 bad705c44807d12463fb587087c4e9eb24769d82981229ac8b74abc9b1a44412
        • MD5 SHA1 SHA512