Loading... Additional Content is being loaded
Analysis Report CoronaWarnApp.apk
Overview
General Information
| Sample Name: | CoronaWarnApp.apk |
| Analysis ID: | 336565 |
| MD5: | de2060e42c95d4dddbf19d85d6da1cd7 |
| SHA1: | 8ebf29e56545925e5d2aa8af413de35cd973eb26 |
| SHA256: | 0d5ec7d8ea87fc80887fa6238dd49572182be98c8b02d9c5dda350a026f16eb7 |
|
Most interesting Screenshot:  |
|
Detection
Anubis
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Detected Anubis BankBot ransomware / banking trojan
Multi AV Scanner detection for submitted file
Deletes other packages
Found large list of e-Banking application (likely related to e-Banking fraud)
Found potential keylogger
Protects itself from removal
Removes its application launcher (likely to stay hidden)
Requests to ignore battery optimizations
Tries to detect Android x86
Tries to detect the analysis device (e.g. the Android emulator)
Tries to disable the administrator user
Uses accessibility services (likely to control other applications)
Accesses android OS build fields
Checks an internet connection is available
Checks if the device administrator is active
Contains package name strings related to banking (usually for identifying banking APKs)
Creates SMS data (e.g. PDU)
Detected TCP or UDP traffic on non-standard ports
Dials phone numbers
Executes logcat command
Executes native commands
Found parser code for incoming SMS (may be used to act on incoming SMS, BOT)
Found suspicious command strings (may be related to BOT commands)
Found very long method strings
Has permission to draw over other applications or user interfaces
Has permission to execute code after phone reboot
Has permission to perform phone calls in the background
Has permission to query the list of currently running applications
Has permission to read contacts
Has permission to read the SMS storage
Has permission to read the phones state (phone number, device IDs, active call ect.)
Has permission to receive SMS in the background
Has permission to record audio in the background
Has permission to send SMS in the background
Has permission to write to the SMS storage
Installs a new wake lock (to get activate on phone screen on)
Lists and deletes files in the same context
May access the Android keyguard (lock screen)
May check for popular installed apps
May query for the most recent running application (usually for UI overlaying)
Monitors incoming SMS
Opens an internet connection
Queries SMS data
Queries a list of installed applications
Queries list of running processes/tasks
Queries phone contact information
Queries the network operator ISO country code
Queries the network operator name
Queries the phones location (GPS)
Queries the unique operating system id (ANDROID_ID)
Queries the unqiue device ID (IMEI, MEID or ESN)
Reads logcat
Records audio/media
Redirects camera/video feed
Requests permissions only permitted to signed APKs
Requests potentially dangerous permissions
Sends SMS using SmsManager
Starts/registers a service/receiver on phone boot (autostart)
Tries to add a new device administrator
Uses reflection
Uses the DexClassLoader (often used for code injection)
Classification
AV Detection: |
  |
|---|
| Antivirus / Scanner detection for submitted sample |
| Source: |
Avira: |
||
| Multi AV Scanner detection for submitted file |
| Source: |
Virustotal: |
Perma Link | ||
Location Tracking: |
|
|---|
| Queries the phones location (GPS) |
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
Privilege Escalation: |
|
|---|
| Checks if the device administrator is active |
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Tries to add a new device administrator |
| Source: |
API Call: |
||
| Source: |
Method string: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
Networking: |
|
|---|
| Checks an internet connection is available |
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Detected TCP or UDP traffic on non-standard ports |
| Source: |
TCP traffic: |
||
| Source: |
TCP traffic: |
||
| Opens an internet connection |
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
TCP traffic detected without corresponding DNS query: |
||
| Source: |
DNS traffic detected: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
Network traffic detected: |
||
| Source: |
Network traffic detected: |
||
| Source: |
Network traffic detected: |
||
| Source: |
Network traffic detected: |
||
| Source: |
Network traffic detected: |
||
| Source: |
Network traffic detected: |
||
Key, Mouse, Clipboard, Microphone and Screen Capturing: |
|
|---|
| Found potential keylogger |
| Source: |
Instruction: |
||
| Source: |
Instruction: |
||
| Source: |
Instruction: |
||
| Source: |
Instruction: |
||
| Source: |
Instruction: |
||
| Source: |
Instruction: |
||
| Source: |
Instruction: |
||
| Source: |
Instruction: |
||
| Source: |
Instruction: |
||
| Source: |
Instruction: |
||
| Has permission to record audio in the background |
| Source: |
Request permission: |
||
| Records audio/media |
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
| Source: |
API Call: |
||
E-Banking Fraud: |
|
|---|
| Detected Anubis BankBot ransomware / banking trojan |
| Source: |
Method string: |
||
| Source: |
Method string: |
||
| Source: |
Method string: |
||
| Source: |
Method string: |
||
| Source: |
Method string: |
||
| Source: |
Method string: |
||
| Source: |
Method string: |
||
| Found large list of e-Banking application (likely related to e-Banking fraud) |
| Contains package name strings related to banking (usually for identifying banking APKs) |
| Source: |
Method String: | ||