Anubis

“This mechanism and similar techniques are the main implementation for the drive-by downloads typically associated with malvertising campaigns.”

Email attachments continue to be the most common delivery mechanism. These typically contain macros or embedded scripts that execute malware under the guise of legitimate business communication.

It will try and trick users into installing it with the fake system update seen in Figure 3.

It highlights something particularly relevant to packing/unpacking: the use of DexClassLoader, an Android class used to load DEX executables, and, in the case of unpacking, to load the unpacked DEX.

“an instruction manual on how to override the device’s security settings in order to enable the installation of the malicious application.”

The Anubis malware masquerades as a benign app, prompts the user to grant it accessibility rights, and also tries to steal account information.

The Anubis malware masquerades as a benign app, prompts the user to grant it accessibility rights, and also tries to steal account information.

In the Android manifest, we quickly notice: 1. Names are obfuscated. That’s frequent with malware... notice the first line creates a variable which is not used: this is junk code, to make reversing complicated.

That path is not in the DEX. This typically indicates the sample is packed, and the manifest references names of an unpacked DEX that we need to recover.

On May 1, 2020, a new version of Android BankBot (aka Anubis, Nautilus Bot) was spotted. The malware poses as an COVID-19 alert application.

We search in the APK and quickly spot a Pa.json among the assets. Unfortunately, it is not a DEX, nor a ZIP, but encrypted content. So, at some point the asset Pa.json is read, then decrypted, then loaded with DexClassLoader.

Based on the signature identifier ‘Trojan:Win64/IcedID.EI!MTB’ and loader’s execution using rundll32.exe with function scab /k accompanied by arguments such as besogon728 or pechene634 or haval462, it can be inferred that the Anubis botnet is in fact IcedID malware.

The malicious app monitors the user's steps through the device motion sensor. If it senses that the user and the device are not moving (if it lacks sensor data and thus, might be running in a sandbox environment), then the malicious code will not run.

a copy of the Anubis banker Trojan ... intercepts and forwards the credentials for online financial transactions to criminals.

It has a built-in keylogger that can simply steal a users’ account credentials by logging the keystrokes.

These malware families are specifically designed to steal credentials related to banking platforms, financial services, and cryptocurrency exchanges.

The malicious app monitors the user's steps through the device motion sensor. If it senses that the user and the device are not moving (if it lacks sensor data and thus, might be running in a sandbox environment), then the malicious code will not run.

Our data shows that the latest version of Anubis has been distributed to 93 different countries and targets the users of 377 variations of financial apps to farm account details. We can also see that, if Anubis successfully runs, an attacker would gain access to contact lists as well as location.

a copy of the Anubis banker Trojan ... intercepts and forwards the credentials for online financial transactions to criminals.

It has a built-in keylogger that can simply steal a users’ account credentials by logging the keystrokes.

The malware can also take a screenshot of the infected users’ screen, which is another way to get the victims credentials.

In its most recent campaigns, FIN7 has been observed deploying the Python-based Anubis backdoor, which provides full system control via in-memory execution and communicates with its command-and-control infrastructure using Base64-encoded data.

"...command-and-control communication..."

If the malicious code runs, then the app will try to trick the users into downloading and installing its payload APK with a fake system update.

SpyNote RAT can copy files from the device to the C2 server. ViceLeaker can copy arbitrary files from the device to the C2 server, can exfiltrate browsing history, can exfiltrate the SD card structure, and can exfiltrate pictures as the user takes them. TriangleDB has collected and exfiltrated files.

Lynx is a ransomware group operating under a double extortion model, combining encryption with data exfiltration.