anubis | f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03

General

Target
f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03.apk
Size 8.6MB
Sample260819-ala1ystdjh
SHA256 f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03
MD5 15c93d07187a38b2bf8f0bc5941e0440
SHA1 dabe6dcc80a0862117812acfaa281b2ef309c5a8
SHA512 6f5aa69b145443860831fc5724a2897e95b5c91e9971c889c88bec142233ee8694460f16be304847a7b30292026b4ae51466be7fa1c8ae9a0bae7d981d032244
SSDEEP 196608:+ol4A6rv15bIQaNN2v9HXbx4anwhh6TS9vwUqK/kLfEs8YqEKxsg:RO5b7amvVLguKwLOCEsRq1ag
TLSH
T1D4961285F748991EC8FB473259FA5232357B8C128F83C697A414327C69BB6D00F99ED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03.apk
- Size 8.6MB
- SHA256 f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03
- MD5 15c93d07187a38b2bf8f0bc5941e0440
- SHA1 dabe6dcc80a0862117812acfaa281b2ef309c5a8
- SHA512 6f5aa69b145443860831fc5724a2897e95b5c91e9971c889c88bec142233ee8694460f16be304847a7b30292026b4ae51466be7fa1c8ae9a0bae7d981d032244
- SSDEEP 196608:+ol4A6rv15bIQaNN2v9HXbx4anwhh6TS9vwUqK/kLfEs8YqEKxsg:RO5b7amvVLguKwLOCEsRq1ag
- TLSH
  T1D4961285F748991EC8FB473259FA5232357B8C128F83C697A414327C69BB6D00F99ED8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
behavioral1
- Target
  base.apk
- Size 4.2MB
- SHA256 a7128bfcdd1fbc8abfdf3749b79d7e3c97cd2524abb2bbb8edb6e032d3324219
- MD5 b323217d8b5386b268de2fe50b45003a
- SHA1 afc8483010eb2311cf2bcc3b7c512d5ea709be58
- SHA512 d06e240805e5a5004c5492b13c52d2668c23844903f429be80eeee4237838ec23dfff95d02522b2da0557b001c74d364f268f1e2dd286ef7a5677ad2d0a7524f
- SSDEEP 98304:QJ48EeKd77j10dYZUvIyv0u9S7s9NGvtmBDaAjCVQECxT5qB:R83Kd3jyeZUvIyv0u9YWNCoaKCeECx1s
- TLSH
  T12D16238077D88E0AE93E16F68A6AC0D5166AFE95DF199307711A371C4B371C0CE63B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion evasion execution anubis infostealer persistence trojan
- Family: Anubis banker
  Android banker that uses overlays.
  banker trojan infostealer anubis
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral2