Anubis

Sitnikov was allegedly charged for posting the source code of the Anubis banking trojan on Freedom F0x, a Telegram channel where Sitnikov often posted data leaks and malware source code

The group utilizes a range of social engineering tactics, including previously undisclosed Microsoft Teams-based campaigns, alongside traditional phishing methods.

MITRE ATT&CK ID Description T1047 Windows Management Instrumentation

After decoding base64, it uses service to decrypt data that encrypted with rc4 scheme... Here is output of my script to get c2 and key from an Anubis sample.

MITRE ATT&CK ID Description T1059.001 Command and Scripting Interpreter: PowerShell

MITRE ATT&CK ID Description T1059.003 Command and Scripting Interpreter: Windows Command Shell

Anubis unpacks the encrypted data file and then drops the decrypted version. Later on malware proceeds loading decrypted dex into the application. After loading with DexClassLoader, malware removes the decrypted dex file.

The most common point of distribution seems to be from the Google Play Store.

A malicious application could create an application overlay window on top of a running legitimate application.

MITRE ATT&CK ID Description T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Once executed, the XLL payload initiates a series of code injection techniques... as one of the security vendors started flagging rundll32-based executions generically, the group was forced to experiment with process injection and alternative staging mechanisms.

A malicious application could create an application overlay window on top of a running legitimate application.

MITRE ATT&CK ID Description T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Anubis has requested accessibility service privileges while masquerading as "Google Play Protect"

At a first look, it seemed clear that the APK was heavily obfuscated... It seems to mostly rely on generating a variety of random functions to hide the real functionalities of the sample... Most of the strings in the code are generated by using functions implementing a XOR decryption of byte arrays.

The source code also appears to have been merged into one main file with most of the function names being obfuscated, as opposed to the previously separated but clear functionality.

Agent Smith can impersonate any popular application on an infected device, and the core malware disguises itself as a legitimate Google application.

Once executed, the XLL payload initiates a series of code injection techniques... as one of the security vendors started flagging rundll32-based executions generically, the group was forced to experiment with process injection and alternative staging mechanisms.

After loading with DexClassLoader, malware removes the decrypted dex file.

I found rc4 key with the help of stackTrace... With bArr2, we can decrypt the encrypted file from images folder of the APK.

Reflection is an important concept in Java which lets you to call methods/classes without knowing about them in compile time... cObj = Class.forName("dalvik.system.dexClassLoader");

“The Overlay attack is a well-known technique implemented on modern Android banking trojans... This usually takes the form of an imitation app or a WebView launched ‘on-top’ of a legitimate application (such as a banking app).”

Malicious functionality in these trojanized contact-tracing applications includes: ... Keylogging ...

Intercepting, redirecting, sending and deleting SMS messages, to bypass SMS-based 2-factor authentication

Harvest entered credentials or credit/debit card details and send them to the C&C server

This has been the dominant method in recent years... mimics the bank’s login page and reels in the victim’s credentials.

MITRE ATT&CK ID Description T1033 System Owner/User Discovery

MITRE ATT&CK ID Description T1082 System Information Discovery

Anubis can exfiltrate files encrypted with the ransomware module from the device and can modify external storage. BusyGasper can collect images stored on the device and browser history. CHEMISTGAMES can collect files from the filesystem and account information from Google Chrome.

“The Overlay attack is a well-known technique implemented on modern Android banking trojans... This usually takes the form of an imitation app or a WebView launched ‘on-top’ of a legitimate application (such as a banking app).”

Malicious functionality in these trojanized contact-tracing applications includes: ... Keylogging ...

Malicious functionality in these trojanized contact-tracing applications includes: ... Voice, Screen, and Camera recording and exfiltration

another trove of data was found within the clipboard synchronization feature. By copy/pasting between victim and attacker machines, operators exposed some additional TTPs and information surrounding their operations.

Malicious functionality in these trojanized contact-tracing applications includes: ... Voice, Screen, and Camera recording and exfiltration

Malicious functionality in these trojanized contact-tracing applications includes: ... Voice, Screen, and Camera recording and exfiltration

In a directory called “/numers/” there were also examples of address book dumps from phone contacts.

this malware uses social media to obtain its C2: it downloads the webpage of a photo-less Instagram account. It then extracts the biography field of this account and decodes it using Base64.

Sitnikov was allegedly charged for posting the source code of the Anubis banking trojan on Freedom F0x

MITRE ATT&CK ID Description T1132.001 Data Encoding: Standard Encoding

MITRE ATT&CK ID Description T1571 Non-Standard Port

SpyNote RAT can copy files from the device to the C2 server. ViceLeaker can copy arbitrary files from the device to the C2 server, can exfiltrate browsing history, can exfiltrate the SD card structure, and can exfiltrate pictures as the user takes them.

Storm-2570 deploys Anubis, DragonForce, Qilin, and BERT ransomware.