Resubmissions

14/11/2026, 20:02

261114-ysdmesvv4q10

14/11/2026, 20:00

261114-yrajdagv2n10

11/10/2026, 10:13

261011-l9b4psgz5n10

General

  • Target
    d4212439e709b6d3f363fecea26e71a6496011a776986698fe34e05bd3766ac4.zip
  • Size 1.5MB
  • Sample261114-ysdmesvv4q
  • SHA256 cf7969d55cf00542d8b81f531dc7494185da925550cdaca3e19877f2d1295983
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • anubis

C2
  • http://cdnjs.su

  • http://ktosdelaetskrintotpidor.com

  • http://sositehuypidarasi.com

Attributes
  • target_apps

    MyING.be

    aib.ibank.android

    alior.bankingapp.android

    at.easybank.securityapp

    at.psa.app.bawag

    at.spardat.bcrmobile

    at.spardat.netbanking

    au.com.bankwest.mobile

    au.com.cua.mb

    au.com.mebank.banking

    au.com.nab.mobile

    au.com.newcastlepermanent

    au.com.suncorp.SuncorpBank

    ccom.tmob.denizbank

    com.DijitalSahne.EnYakinHalkbank

    com.FubonMobileClient

    com.MobileTreeApp

    com.Plus500

    com.abnamro.nl.mobile.payments

    com.advantage.RaiffeisenBank

    com.aff.otpdirekt

    com.amazon.windowshop

    com.att.myWireless

    com.axis.mobile

    com.bankaustria.android.olb

    com.bankia.wallet

    com.bankinter.launcher

    com.bankofamerica.cashpromobile

    com.bankofqueensland.boq

    com.barclays.android.barclaysmobilebanking

Targets

    • Target
      d4212439e709b6d3f363fecea26e71a6496011a776986698fe34e05bd3766ac4.zip
    • Size 1.5MB
    • SHA256 cf7969d55cf00542d8b81f531dc7494185da925550cdaca3e19877f2d1295983
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      d4212439e709b6d3f363fecea26e71a6496011a776986698fe34e05bd3766ac4.zip
    • Size 1.8MB
    • SHA256 d4212439e709b6d3f363fecea26e71a6496011a776986698fe34e05bd3766ac4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Family: Anubis banker

      Android banker that uses overlays.

    • Family: CometBot

      CometBot is an Android banking trojan first seen in 2019.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries account information for other applications stored on the device

      Application may abuse the framework's APIs to collect account information stored on the device.

    • Reads the contacts stored on the device.

    • Reads the content of the calendar entry data.

    • Reads the content of the call log.

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries information about active data network

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v16

Tasks