Anubis Malware Internals-0x01
Static and Dynamic Analysis of “Pandemi Desteğini aktif et” App.
Introduction:
Few hours ago , on Twitter “Malware Hunter Team” had shared the link to app called “Pandemi Desteğini aktif et — 1.0". We decided to take a look on reversing it.
Analysis of “Pandemi Desteğini aktif et”
It’s the Fake App/Anubis Malware CopyCat of “ e-Devlet Kapısı ” which is the e-Government Gateway services Android App of Turkish Government.
Static Analysis:~
Hash’s:
Information about app :
Certificate Info:
App Permissions:
Obfuscation and Anti-VM Code:
Code Analysis:
App logs into the sensitive information of user which should never be logged. It also has ability to read and write into the external storage and also uses the insecure RNG [Random Number Generator ] and SSL. Moreover , it has weak hash’s and also stores the sensitive information of user in temp file and discloses the IP address of device.
URLs:
Email:
Secret Activities:
Services run by App:
Dynamic Analysis:~
Running app dynamically on emulator [ android VM ] .it popup with this sending the SMS using rare.ethics.across.kldqwysgkfcrmq.onHandleIntent.
Urls:
Emails:
Logs:
Conclusion:
Threat Actors are being continuously targeting the citizens of Turkey and committing fake Apps relating to Turkish Government with in-build Anubis malware in malicious Apps.
0x00 blog of Anubis Malware Internal can be read from here:
That’s all for today.
