anubis | b8d245b62fdb7370aaef0133b62c25c3eb60d2d0f15d8170b2255c26d489a589

General

Target
b11e45e1f7f4dca9327a10a572c18623.apk
Size 359KB
Sample260821-m849jadj2x
SHA256 b8d245b62fdb7370aaef0133b62c25c3eb60d2d0f15d8170b2255c26d489a589
MD5 b11e45e1f7f4dca9327a10a572c18623
SHA1 6303eaacb5e1a36947968421e42aa797e6498ce7
SHA512 cacc830cc849cabea7bb4011315b7bd3f9448e2a3b950fdbad69292c3f3b79f3d044a5676c23161c78465e39c4b96190473f53c65844caed98e05c61e9a239b9
SSDEEP 6144:MupToo0rsm1zX72D8T/vBY5C7w+U4PQbLiNG3HxFDh0M65IsSQDt/:JpTo5smB7/y34PEiShj65IsSQJ/
TLSH
T17274F162FB59841AD6FBE533C713137221339D196E93EE876B42B7082C716909F5AC88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  b11e45e1f7f4dca9327a10a572c18623.apk
- Size 359KB
- SHA256 b8d245b62fdb7370aaef0133b62c25c3eb60d2d0f15d8170b2255c26d489a589
- MD5 b11e45e1f7f4dca9327a10a572c18623
- SHA1 6303eaacb5e1a36947968421e42aa797e6498ce7
- SHA512 cacc830cc849cabea7bb4011315b7bd3f9448e2a3b950fdbad69292c3f3b79f3d044a5676c23161c78465e39c4b96190473f53c65844caed98e05c61e9a239b9
- SSDEEP 6144:MupToo0rsm1zX72D8T/vBY5C7w+U4PQbLiNG3HxFDh0M65IsSQDt/:JpTo5smB7/y34PEiShj65IsSQJ/
- TLSH
  T17274F162FB59841AD6FBE533C713137221339D196E93EE876B42B7082C716909F5AC88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion anubis cometbot infostealer persistence stealth trojan
- Family: Anubis banker
  Android banker that uses overlays.
  banker trojan infostealer anubis
- Family: CometBot
  CometBot is an Android banking trojan first seen in 2019.
  trojan infostealer banker cometbot
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Requests enabling of the accessibility settings.
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral1