anubis | a7128bfcdd1fbc8abfdf3749b79d7e3c97cd2524abb2bbb8edb6e032d3324219

Analysis

max time kernel
91s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
19/08/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
base.apk
Size 4.2MB
Sample260819-ala1ystdjh
SHA256 a7128bfcdd1fbc8abfdf3749b79d7e3c97cd2524abb2bbb8edb6e032d3324219
MD5 b323217d8b5386b268de2fe50b45003a
SHA1 afc8483010eb2311cf2bcc3b7c512d5ea709be58
SHA512 d06e240805e5a5004c5492b13c52d2668c23844903f429be80eeee4237838ec23dfff95d02522b2da0557b001c74d364f268f1e2dd286ef7a5677ad2d0a7524f
SSDEEP 98304:QJ48EeKd77j10dYZUvIyv0u9S7s9NGvtmBDaAjCVQECxT5qB:R83Kd3jyeZUvIyv0u9YWNCoaKCeECx1s
TLSH
T12D16238077D88E0AE93E16F68A6AC0D5166AFE95DF199307711A371C4B371C0CE63B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker collection credential_access defense_evasion evasion execution anubis infostealer persistence trojan

Malware Config

Signatures

Family: Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tencent.mm/files/arm/classes.dex	4748	com.tencent.mm
/data/user/0/com.tencent.mm/files/arm/classes.dex	4748	com.tencent.mm
/data/user/0/com.tencent.mm/files/arm/classes.dex (deleted)	4748	com.tencent.mm
/data/user/0/com.tencent.mm/files/arm/classes.dex (deleted)	4748	com.tencent.mm
/data/user/0/com.tencent.mm/files/arm/classes.dex	5107	com.tencent.mm:remote
/data/user/0/com.tencent.mm/files/arm/classes.dex	5107	com.tencent.mm:remote

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.tencent.mm

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.tencent.mm

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.tencent.mm

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.tencent.mm
Framework service call	android.app.job.IJobScheduler.schedule	com.tencent.mm:remote

com.tencent.mm
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Schedules tasks to execute at a specified time
PID:4748

com.tencent.mm:remote
1⤵
- Loads dropped Dex/Jar
- Schedules tasks to execute at a specified time
PID:5107

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

evernote_jobs.db

Path /data/user/0/com.tencent.mm/databases/evernote_jobs.db
Size 16KB
SHA256 de9d04ed2d9c3572436d1d5e49c84b2ef43865ae0c86c91811d74e4eeb4c472c
MD5 56ce82a89bdddc1966fbbef085252a7f
SHA1 a68bfc1aa4e3068551e3d3405e9fbd026bca87bf
SHA512 272c6fc51ab5211043a912d7706101d77cd8b4b65959f3b4cb4cee21028328924236e0fc28f381e05a81f1df741fde563352bfddce5c5b14ecb1b8e48ba88a79
SSDEEP 12:TLRXpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbBvOwFF2PWOs:TLBpOKRvTZYAZ3mGSNFFeWOeWOJeWOg
TLSH
T1D872C899F7402E21EF9C4DB24486D7D00625E6FE66D0C2EBA238CCB48CC3C1852ACE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.tencent.mm/databases/evernote_jobs.db-journal
Size 8KB
SHA256 2ef6603df666597346cda0c5b54c0d130b55e67302e85cad64fd25176b5f705f
MD5 98a0c6476aa7ee74b29a5c33e2970945
SHA1 0a8cecca0724acf79cede4cadc4e69973af25cc2
SHA512 0c82e51d7cc701cf91feb5bd1c9f905665096a8fcd94cadfd9d501f3fcc326f257d55be4c9af6acd78fbbaff368589998dd7c4055a09bd156b3170023f9f7bc8
SSDEEP 12:7+tbdmf2PWO2PWOyqL+sVpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeU:7+tEfeWOeWOyqLxpOKRvTZYAZ3mGSfv
TLSH
T11E02AB19F7402E12EF9C0DB2444AC3D00625D6EA66D2C2EB5178CDB45CC7C14526EE70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.tencent.mm/databases/evernote_jobs.db-journal
Size 8KB
SHA256 72d87b693cd896c85142dd7579e41b8ce075a80043177c45e91ead4019c08760
MD5 232fc09261545959ebdf22af15c0327d
SHA1 d88e16aa3ad20ff5a31668dbb91585385dafb049
SHA512 4a2af48c7ea6b69124fd0d0510cb866fc659a4229fe4632067ee86fead08b4ec19f527828805719f55b296eac92bb4cc7612e66cc60a73e933567d9dc3836131
SSDEEP 6:7+/l9Htn14Vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKr:7+tl0VqLiuWdYRmBEyPbU
TLSH
T18302C0AEE3800813CC2D567B90D4C3440D00F7288171CB9B1A9208983C076CCE8A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.tencent.mm/databases/evernote_jobs.db-journal
Size 8KB
SHA256 f88371303824983faff36910c7b790a19f1d723403196eec12ce2a703dd8fdf2
MD5 3ea9e18df8ef7ba5292d12905a33ffac
SHA1 a3b71a87fdb90aaead66ca968e679afb805f72e8
SHA512 ed81d83d67caef7cbbd83975e2c9a7b3b863a1fb50a027b30d78033abca21224e388f5ea230f911578278e0348cd244194b9cbdd7100858946eab3df383649f8
SSDEEP 6:7+/l9TOPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKj/b:7+tMqLJdeWRmBEyPbgb
TLSH
T18402228963400C03C42ED77BE0C883581E14A7289373CB4B269108682C06ACEA890D88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.tencent.mm/databases/evernote_jobs.db-journal
Size 8KB
SHA256 3eb4d9464fb4f8df177b7ea9831e2e31cbee90872a3b98960394c74b2ee48b09
MD5 e62a641a15c7be3d05387aba0d1005a0
SHA1 0a24c012772bac695f4cf204ab72ffcb52798494
SHA512 dcb6ee3a5580317aa46f37fe35f37792836689050f9c7eee85924ee400aa05b4ba89325ef963d8f16bc73b75b83e3ec46ecdf59d350c2229b81b725530d794e8
SSDEEP 12:7+tROdqLpvpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbe:7+tRyqLhpOKRvTZYAZ3mGSe
TLSH
T13602994A97802D02EF8D4E765165C3C06A35E35F61D1C7EB61B8CEB00CC6D6591BEE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.dex

Path /data/user/0/com.tencent.mm/files/arm/classes.dex
Size 8.9MB
SHA256 d836c5fcc793a03989ec07a83de925bc454e45303003b87439e8c0f68bdb052e
MD5 00a166d9cff00eb01c0620ae52273055
SHA1 a78270e2ecb12fffd858b6b62d27b9e2b46265f2
SHA512 53536a5e03e4ce56f1b1ac3fd208467ab068aaec978235d295fba33c49bdf2f14317488b03022eb60b1f659662bd9622e9a41da66fb1bf841dd103f2d856a827
SSDEEP 98304:TgVc4rbyziMK62RM+07lqH3DBO9Q836nh7syjO8Mpj:ibvi9Q7r68M
TLSH
T1BD969D03EB265D36D0AE833648F747417735624BAB8397138566D4BCBCE22D09BCE2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log-2026-08-19.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2026-08-19.txt
Size 268B
SHA256 5893c0ce12dbefd24c724ca56636d2aed63d84808b47bb4b5c204899bb50cb81
MD5 1dc68e40262bcd60541a37156f6ba84a
SHA1 74eddfad93486f0f7e9bce1e5a44cc81d489fe95
SHA512 aa3375980fff7cf165ea007345bbb746ae7c5415eaed564fd13e24ac70959a369700cbdd9aae96e475db36904542b28b8d83197082c05819fcc2861173b81e19
TLSH
T1D6D0958BC90D5D92DF3CC30079F82911DD15C1FE124D293049519D190B7459F66D5EDE
MD5 SHA1 SHA512 TLSH

Submit Download

log-2026-08-19.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2026-08-19.txt
Size 29B
SHA256 5a290151305de1ec4f790cd8ada8bd68c076a2c4ed497c40a519509659b65150
MD5 b9b530e2448252311640bbecb69b796a
SHA1 215ede46fb42a68a7ae84c3019acb3019668a46c
SHA512 5834499307946d130887067b2f837ddfef7fdfe3a7e5ed8977eb14c2dc1ab328334da35ed4c978e20b3e6b28ff30dbd12f0430f4b7c831481f339d360c260919
MD5 SHA1 SHA512

Submit Download

log-2026-08-19.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2026-08-19.txt
Size 13B
SHA256 af2231aaeeee16d548418d872b61e50f05602bc5bc2f19f99a18fd17178a5803
MD5 90d0fa7ccdb0cb7811deebf7ba61bcd8
SHA1 5df3531436beb45f541a2ecf66f9d5b63e1fd8e8
SHA512 c4e7bcdb35bb47e8204dbc8a882bbb95dc4fe54d8d42c3f935d2e43b87754df6744e5a1b8cf672213760b666e66381fd2876d8ad928670645a3f6eca1a25ffaa
MD5 SHA1 SHA512

Submit Download

log-2026-08-19.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2026-08-19.txt
Size 25B
SHA256 2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
MD5 ba30336bf53d54ed3c0ea69dd545de8c
SHA1 ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA512 eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads