General

  • Target
    b4bd65520d764bea63e2956f63cfe1e79109aa63efc39f3fd938e29df77cf0fd.zip
  • Size 357KB
  • Sample260826-mmszdacj4s
  • SHA256 b5332da01e69ae824627caf66c4fda0f61c9cc7ee544705b8bb108b1e3c4628f
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • anubis

C2
  • http://ktosdelaetskrintotpidor.com

  • http://sositehuypidarasi.com

  • https://qzwrxetcryvtubynumnuybtvrcewsdcfv.com

Attributes
  • target_apps

    MyING.be

    aib.ibank.android

    alior.bankingapp.android

    at.easybank.securityapp

    at.psa.app.bawag

    at.spardat.bcrmobile

    at.spardat.netbanking

    au.com.bankwest.mobile

    au.com.cua.mb

    au.com.mebank.banking

    au.com.nab.mobile

    au.com.newcastlepermanent

    au.com.suncorp.SuncorpBank

    ccom.tmob.denizbank

    com.DijitalSahne.EnYakinHalkbank

    com.FubonMobileClient

    com.MobileTreeApp

    com.Plus500

    com.abnamro.nl.mobile.payments

    com.advantage.RaiffeisenBank

    com.aff.otpdirekt

    com.amazon.windowshop

    com.att.myWireless

    com.axis.mobile

    com.bankaustria.android.olb

    com.bankia.wallet

    com.bankinter.launcher

    com.bankofamerica.cashpromobile

    com.bankofqueensland.boq

    com.barclays.android.barclaysmobilebanking

Extracted

Family
  • anubis

C2
  • http://ktosdelaetskrintotpidor.com

  • http://sositehuypidarasi.com

Targets

    • Target
      b4bd65520d764bea63e2956f63cfe1e79109aa63efc39f3fd938e29df77cf0fd.apk
    • Size 361KB
    • SHA256 b4bd65520d764bea63e2956f63cfe1e79109aa63efc39f3fd938e29df77cf0fd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Anubis payload

    • Family: Anubis banker

      Android banker that uses overlays.

    • Family: CometBot

      CometBot is an Android banking trojan first seen in 2019.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries the phone number (MSISDN for GSM devices)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries information about active data network

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Requests enabling of the accessibility settings.

    • Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Mobile v16

Tasks