Anubis Android银行木马技术分析及新近活动总结

背景介绍

Anubis(阿努比斯)是古埃及神话中的死神,以胡狼头、人身的形象出现在法老的壁画中。同时Anubis也是一种Android银行恶意软件,自2017年以来已经为全球100多个国家,300多家金融机构带来了相当大的麻烦。Anubis截止到目前为止,爆发地主要为欧洲国家,国内暂未发现该银行木马。

Anubis主要通过伪装成金融应用、手机游戏、购物应用、软件更新、邮件应用、浏览器应用甚至物流应用等,从而渗透进谷歌应用商店,诱骗用户下载安装。

Anubis木马功能强大,自身结合了钓鱼、远控、勒索木马的功能。Anubis通过仿冒各种应用诱骗用户安装使用,当软件被激活后,会展现给用户一个仿冒的钓鱼页面,从而获取用户敏感信息,如银行账号密码、个人身份信息等。Anubis具备一般银行木马的功能,包括屏蔽用户短信,获取转发用户短信等功能。Anubis同时可以从服务端获取远控指令,对用户手机进行进一步控制。Anubis还是第一个集成勒索软件功能的Android银行木马。Anubis功能之多、之强大,甚至可以作为间谍软件进行使用。

近期有国外安全研究者发现一款仿冒为西班牙邮政运营商Correos的恶意软件,该恶意软件运行后会释放仿冒为Google Play Service Updater V2.1的Anubis木马程序,诱骗用户安装更新。

诱饵关联

本次Anubis的载体为仿冒为西班牙邮政运营商Correos的恶意软件:

Correos官网:

经过盘古团队的Janus系统关联分析,我们发现了最新的12个Anubis载体,其图标去重后如下:

本次Anubis载体代码结构也基本相同:

样本分析

文件名称Correos Rastreo.apk
软件名称Correos Rastreo
软件包名com.consultar.rastero
MD504D94228021B73E44261ADCCAD4173F3
安装图标

Anubis银行木马到目前为止功能大同小异,虽然仿冒的种类繁多,但核心代码结构并未有巨大的改变。Anubis代码核心以远控为主体,钓鱼、勒索等其它功能为辐,目的则为获取用户关键信息,窃取用户财产。

仿冒为Correos的程序运行后,会诱骗用户安装更新Google Play,而该更新软件即为Anubis木马程序。

仿冒为Correos的样本运行界面:

诱骗用户安装仿冒为Google Play Service Updater V2.1的Anubis木马程序:

通过拼接字符串获取下载链接:

访问数据:

获取到的Anubis木马程序:

当Anubis木马运行后,依然延续了恶意软件的“做贼心虚”的本质,先隐藏自身,达到保护自身的目的:

通过服务器可以下发30多种指令,获取对用户手机的全面控制权,其中主要功能有,获取键盘记录、加密用户手机文件、开启VNC远程、打开指定web界面等。

获取指令及上传获取到的用户信息的URL拼接:

主要远控指令分析:

主要远控指令指令对应的功能
Send_GO_SMS向指定电话号码发送指定内容
nymBePsG0获取用户手机通讯录
GetSWSGO获取用户手机短信
telbookgotext=
getapps获取用户手机已安装应用
getpermissions获取已有的权限信息
startaccessibility权限请求
startpermission权限请求
=ALERT|提示消息
=PUSH|推送通知
startAutoPush根据不同国家,推送不同的消息
RequestPermissionGPS请求获取地理位置权限
|ussd=呼叫转移
|recordsound=录音
|replaceurl=替换URL
|startapplication=启动指定应用
getkeylogger获取键盘记录
stopsound停止录音
startsound开始录音
startscreenVNC开启VNC远控
deletefilefolder:删除文件
downloadfile:下载文件
opendir:获取文件路径
startforward=启动呼叫转移功能到指定号码
stopforward停止呼叫转移功能
|openbrowser=打开浏览器
|openactivity=启动ActivityURL,打开一个web页面
|cryptokey=对用户手机对应文件进行加密操
|decryptokey=对用户手机对应文件进行解密操作
getip获取用户IP地址

指令 “Send_GO_SMS”:向指定电话号码发送指定内容

指令 “nymBePsG0”:获取用户手机通讯录。

指令 “GetSWSGO”:获取用户手机短信。

指令 “|telbookgotext=”:获取用户手机通讯录。

指令 “getapps”:获取用户手机已安装应用。

指令 “getpermissions”:获取已有的权限信息。

指令 “startaccessibility”:权限请求。

指令 “startpermission”:权限请求。

指令 “=ALERT|”:提示消息。

指令 “=PUSH|”:推送通知。

指令 “startAutoPush”:根据不同国家,推送不同的消息。

指令 “RequestPermissionGPS”:请求获取地理位置权限。

指令 “|ussd=”:呼叫转移。

指令 “|recordsound=”:录音。

指令 “|replaceurl=”:替换URL。

指令 “|startapplication=”:启动指定应用。

指令 “getkeylogger”:获取键盘记录。

指令 “stopsound”:停止录音。

指令 “startsound”:开始录音。

指令 “startscreenVNC”:开启VNC远控。

指令”deletefilefolder:”:删除文件。

指令 “downloadfile:”:下载文件。

指令 “opendir:”:获取文件路径。

指令 “startforward=”:启动呼叫转移功能到指定号码。

指令 “stopforward”:停止呼叫转移功能。

指令 “|openbrowser=”:打开浏览器。

指令 “|openactivity=”:启动ActivityURL,打开一个web页面。

指令 “|cryptokey=”:对用户手机对应文件进行加密操作

指令 “|decryptokey=”:对用户手机对应文件进行解密操作。

指令 “getip”:获取用户IP地址。

同源分析

通过分析样本远控代码,我们可以发现其功能繁多且全面,对应不同的指令功能,我们不难理解整个木马的运作流程及各个功能的目的。值得注意的是,木马有打开WEB页面的操作,虽然目前该URL已经失效,但我们结合之前的同源样本分析结果,可以发现要打开的URL即为钓鱼页面。

同源样本中,打开推特链接:

现已失效:

同源样本中之前国外的分析结果,打开推特获取备份C2:

打开解析后的链接,即为仿冒银行的登录页面:

新发现的Anubis相比于以前的做了加固处理,但是脱壳之后代码结构与之前的没有多大改变。

经过加固的代码结构:

脱壳后的代码结构:

Anubis旧版本代码结构:

新近活动

我们对2019年后的Anubis样本进行了数据统计,以便后期可以更好的进行监控。

统计Anubis仿冒的主要图标,我们可以发现,Anubis木马主要通过仿冒一些主流的应用或者浏览器插件,诱骗用户进行更新,从而可以最大限度的迷惑用户,使木马本身可以顺利安装到用户手机中。

通过统计2019年前4个月Anubis数量变化,我们可以发现,Anubis并没有因去年在国外大规模的爆发,被谷歌进行清理封杀而彻底消失或数量减少,其仍然一直存活着而且数量并没有减少,不间断的仍然会有人中木马病毒,虽然其域名被大量封杀,但并不能说明Anubis对用户手机已没有任何威胁,我们依然要谨防新的变种出现。

通过统计主要受害国家,我们可以看到受害国家主要集中在欧美地区,而土耳其与美国受害者最多,虽然目前国内暂未发现Anubis木马病毒,但我们也不能大意:

此外附上由Threatfabric总结的,Anubis自爆发以来仿冒全球378个金融机构应用程序信息:

Package nameApplication name
MyING.beING Smart Banking
alior.bankingapp.androidUsługi Bankowe
at.bawag.mbankingBAWAG P.S.K.
at.easybank.mbankingeasybank
at.easybank.securityappeasybank Security App
at.easybank.tableteasybank app
at.psa.app.bawagBAWAG P.S.K. SmartPay
at.spardat.bcrmobileTouch 24 Banking BCR
at.spardat.netbankingErsteBank/Sparkasse netbanking
at.volksbank.volksbankmobileVolksbank Banking
au.com.bankwest.mobileBankwest
au.com.cua.mbCUA
au.com.ingdirect.androidING Australia Banking
au.com.mebank.bankingME Bank
au.com.nab.mobileNAB Mobile Banking
au.com.newcastlepermanentNPBS Mobile Banking
au.com.suncorp.SuncorpBankSuncorp Bank
biz.mobinex.android.apps.cep_sifrematikGaranti Cep Şifrematik
by.st.alfaАльфа-Бизнес Мобайл Беларусь
com.DijitalSahne.EnYakinHalkbankHalkbank Nerede
com.FubonMobileClientFubon HK
com.MobileTreeAppDah Sing Bank
com.Plus500Plus500: CFD Online Trading on Forex and Stocks
com.SifrebazCepHalkbank Şifrebaz Cep
com.abnamro.nl.mobile.paymentsABN AMRO Mobiel Bankieren
com.advantage.RaiffeisenBankRaiffeisen Smart Mobile
com.aff.otpdirektOTP SmartBank
com.akbank.android.apps.akbank_direktAkbank Direkt
com.akbank.android.apps.akbank_direkt_tabletAkbank Direkt Tablet
com.akbank.softotpAkbank Direkt Şifreci
com.amazon.mShop.android.shoppingAmazon Shopping
com.amazon.windowshopAmazon for Tablets
com.anz.androidANZ Mobile Taiwan
com.anz.android.gomoneyANZ Australia
com.anzspot.mobileANZ Spot
com.arubanetworks.atmanzAtmosphere ANZ
com.axis.mobileAxis Mobile- Fund Transfer,UPI,Recharge & Payment
com.bankaustria.android.olbBank Austria MobileBanking
com.bankia.walletBankia Wallet
com.bankinter.launcherBankinter Móvil
com.bankofamerica.cashpromobileCashPro® + Token
com.bankofqueensland.boqBOQ Mobile
com.barclays.android.barclaysmobilebankingBarclays Mobile Banking
com.barclays.ke.mobile.android.uiBarclays Kenya
com.bawagpsk.securityappBAWAG P.S.K. Security App
com.bbva.bbvacontigoBBVA Spain
com.bbva.bbvawalletBBVA Wallet Spain. Mobile Payment
com.bbva.netcashBBVA Net cash
com.bendigobank.mobileBendigo Bank
com.binance.devBinance – Cryptocurrency Exchange
com.binance.odapplicationsBinance: Cryptocurrency & Bitcoin Exchange
com.bitcoin.ss.zebpayindiaZebpay India
com.bitfinex.bfxappBitfinex
com.bitmarket.traderAplikacja Bitmarket
com.blockfolio.blockfolioBlockfolio – Bitcoin and Cryptocurrency Tracker
com.bmo.mobileBMO Mobile Banking
com.boursorama.android.clientsBoursorama Banque
com.bssys.VTBClientMobile Client VTB
com.bssys.vtb.mobileclientMobileClientVTB
com.btcturkBtcTurk Bitcoin Borsası
com.caisseepargne.android.mobilebankingBanque
com.cba.android.netbankCommBank app for tablet
com.chase.sig.androidChase Mobile
com.cibc.android.mobiCIBC Mobile Banking®
com.citi.citimobileCiti Mobile®
com.citibank.mobile.auCitibank Australia
com.citibank.mobile.ukCiti Mobile UK
com.clairmail.fthFifth Third Mobile Banking
com.cleverlance.csas.servis24SERVIS 24 Mobilni banka
com.cm_prod.badCrédit Mutuel
com.cm_prod.epasalEpargne Salariale CM
com.cm_prod.nosactusCrédit Mutuel – Nos Actus
com.cm_prod_tablet.badCrédit Mutuel pour Tablettes
com.coin.profitCoin Profit
com.coinbase.androidCoinbase – Buy Bitcoin & more. Secure Wallet.
com.coins.bit.localLocalBitCoins
com.coins.ful.bitLocalBitCoins NEW
com.comarch.mobile.banking.bgzbnpparibas.biznesMobile BiznesPl@net
com.comarch.security.mobilebankingINGBusiness
com.commbank.netbankCommBank
com.crowdcompass.appSQ0QACAcYJANZ Investor Tour
com.crypter.cryptocyrrencyCrypto App – Widgets, Alerts, News, Bitcoin Prices
com.csam.icici.bank.imobileiMobile by ICICI Bank
com.db.mm.deutschebankMeine Bank
com.db.mm.norisbanknorisbank App
com.db.pwcc.dbmobileDeutsche Bank Mobile
com.dbs.hk.dbsmbankingDBS digibank Hong Kong
com.de.dkb.portalappDKB-Banking
com.ebay.mobileFashion & Tech Deals – Shop, Sell & Save with eBay
com.edsoftapps.mycoinsvalueMy CryptoCoins Portfolio – All Coins
com.empik.empikappEmpik
com.empik.empikfotoEmpik Foto
com.entersekt.authapp.sparkasseS-ID-Check
com.fi6122.godoughTSB Mobile
com.finansbank.mobile.cepsubeQNB Finansbank Cep Şubesi
com.finanteq.finance.caCA24 Mobile
com.fragment.akbankAkbank Sanat
com.fusion.ATMLocatorPeople’s Choice Credit Union
com.garanti.cepbankGaranti CepBank
com.garanti.cepsubesiGaranti Mobile Banking
com.garantibank.cepsubesiroGarantiBank
com.garantiyatirim.fxGaranti FX Trader
com.getingroup.mobilebankingGetin Mobile
com.grppl.android.shell.BOSBank of Scotland Mobile Banking: secure on the go
com.grppl.android.shell.CMBlloydsTSB73Lloyds Bank Mobile Banking
com.grppl.android.shell.halifaxHalifax: the banking app that gives you extra
com.hangseng.rbmobileHang Seng Personal Banking
com.htsu.hsbcpersonalbankingHSBC Mobile Banking
com.idamob.tinkoff.androidTinkoff
com.idbi.mpassbookIDBI Bank mPassbook
com.idbibank.abhay_cardAbhay by IDBI Bank Ltd
com.ideomobile.hapoalimבנק הפועלים – ניהול החשבון‎
com.ifs.banking.fiid4202TSBBank Mobile Banking
com.imb.banking2IMB.Banking
com.infonow.bofaBank of America Mobile Banking
com.infrasofttech.indianBankIndPay
com.ing.diba.mbbr2ING-DiBa Banking + Brokerage
com.ing.mobileING Bankieren
com.ingbanktr.ingmobilING Mobil
com.isis_papyrus.raiffeisen_pay_eyewdgRaiffeisen ELBA
com.jackpf.blockchainsearchBitcoin Blockchain Explorer
com.jamalabbasii1998.localbitcoinLocal BitCoin
com.jiffyondemand.userJiffy
com.konylabs.capitaloneCapital One® Mobile
com.kryptokit.jaxxJaxx Blockchain Wallet
com.kutxabank.androidKutxabank
com.kuveytturk.mobilMobil Şube
com.latuabanca_tabperandroidLa tua banca per Tablet
com.latuabancaperandroidIntesa Sanpaolo Mobile
com.localbitcoins.exchangeLocalBitcoins – Buy and sell Bitcoin
com.localbitcoinsmbappLocalBitCoins Official
com.lynxspa.bancopopolareYouApp
com.magiclick.FinansPOSFinansPOS
com.magiclick.odeabankOdeabank
com.mal.saul.coinmarketcapCoin Market-Bitcoin Prices,Currencies,BTC,EUR,ICO
com.matriksdata.finansyatirimQNB Finansinvest
com.matriksdata.ziraatyatirim.padZiraat Trader HD
com.matriksmobile.android.ziraatTraderZiraat Trader
com.mobikwik_newMobile Recharge,Bill Payments,UPI & Money Transfer
com.mobillium.paparaPapara Cüzdan
com.moneybookers.skrillpaymentsSkrill
com.moneybookers.skrillpayments.netellerNETELLER
com.monitise.isbankmoscowISBANK Online
com.mtel.androidbeaBEA 東亞銀行
com.mycelium.walletMycelium Bitcoin Wallet
com.oxigen.oxigenwalletBill Payment & Recharge,Wallet
com.palatine.android.mobilebanking.prodePalatine Particuliers
com.paypal.android.p2pmobilePayPal Cash App: Send and Request Money Fast
com.phyder.engageRBS
com.plunien.poloniexPoloniex
com.portfolio.coinbase_trackerCoinbase Tracker (3rd party)
com.pozitron.albarakaturkAlbaraka Mobil Şube
com.pozitron.iscepİşCep
com.pozitron.vakifbankVakıfBank Cep Şifre
com.quickmobile.anzirevents15ANZ Investor Relations Events
com.rbc.mobile.androidRBC Mobile
com.rbs.mobile.android.natwestNatWest Mobile Banking
com.rbs.mobile.android.natwestbandcNatWest Business Banking
com.rbs.mobile.android.natwestoffshoreNatWest International
com.rbs.mobile.android.rbsRoyal Bank of Scotland Mobile Banking
com.rbs.mobile.android.rbsbandcRBS Business Banking
com.rbs.mobile.android.ubrUlster Bank RI Mobile Banking
com.rbs.mobile.investisirRBS Investor & Media Relations
com.redrockdigimarkQNB National Day
com.rsiruralvía
com.santander.appSantander Brasil
com.sbi.SBIFreedomPlusSBI Anywhere Personal
com.scb.breezebanking.hkSC Mobile Hong Kong
com.scotiabank.mobileScotiabank Mobile Banking
com.snapwork.IDBIIDBI Bank GO Mobile+
com.snapwork.hdfcHDFC Bank MobileBanking
com.softtech.isbankasiİşTablet
com.softtech.iscekÇEKSOR
com.sovereign.santanderSantander Bank US
com.starfinanz.mobile.android.pushtanS-pushTAN
com.starfinanz.smob.android.sbankingSparkasse+ Finanzen im Griff
com.starfinanz.smob.android.sfinanzstatusSparkasse Ihre mobile Filiale
com.starfinanz.smob.android.sfinanzstatus.tabletSparkasse fürs Tablet
com.suntrust.mobilebankingSunTrust Mobile App
com.targo_prod.badTARGOBANK Mobile Banking
com.tdTD Canada
com.tebCEPTETEB
com.tecnocom.cajalaboralBanca Móvil Laboral Kutxa
com.thunkable.android.manirana54.LocalBitCoinsLocalBitCoins
com.thunkable.android.manirana54.LocalBitCoins_unblockUNBLOCK Local BitCoins
com.thunkable.android.santoshmehta364.UNOCOIN_LIVEUNOCOIN LIVE
com.tmob.denizbankMobilDeniz
com.tmob.tabletdenizMobilDeniz Tablet
com.tmobtech.halkbankHalkbank Mobil
com.tnx.apps.coinportfolioCoin Portfolio for Bitcoin & Altcoin tracker
com.triodos.bankingnlTriodos Bankieren NL
com.unicreditMobile Banking UniCredit
com.unionbank.ecommerce.mobile.androidUnion Bank Mobile Banking
com.unionbank.ecommerce.mobile.commercial.legacyUnion Bank Commercial Clients
com.unocoin.unocoinmerchantPoSUnocoin Merchant PoS
com.unocoin.unocoinwalletUnocoin Wallet
com.usaa.mobile.android.usaaUSAA Mobile
com.usbank.mobilebankingU.S. Bank
com.vakifbank.mobileVakıfBank Mobil Bankacılık
com.veripark.ykbazYapıKredi Azərbaycan MobilBank
com.vipera.ts.starter.QNBQNB Mobile
com.vtb.mobilebankVTB Mobile Georgia
com.wellsFargo.ceomobileWells Fargo CEO Mobile®
com.wf.wellsfargomobileWells Fargo Mobile
com.wf.wellsfargomobile.tabletWells Fargo for Tablet
com.yinzcam.facilities.verizonCapital One Arena Mobile
com.ykb.androidYapı Kredi Mobile
com.ykb.android.mobilonayYapı Kredi Corporate-For Firms
com.ykb.androidtabletYapı Kredi Mobil Şube
com.ykb.avmYapı Kredi Cüzdan
com.yurtdisi.iscepJSC İŞBANK
com.ziraat.ziraatmobilZiraat Mobil
com.ziraat.ziraattabletZiraat Tablet
cz.airbank.androidMy Air
cz.csob.smartbankingČSOB SmartBanking
cz.sberbankczSmart Banking
de.comdirect.androidcomdirect mobile App
de.commerzbanking.mobilCommerzbank Banking App
de.consorsbankConsorsbank
de.dkb.portalappDKB-Banking
de.fiducia.smartphone.android.banking.vrVR-Banking
de.fiducia.smartphone.android.securego.vrVR-SecureGo
de.postbank.finanzassistentPostbank Finanzassistent
de.schildbach.walletBitcoin Wallet
es.bancopopular.nbmpopularPopular
es.bancosantander.appsSantander
es.cm.androidBankia
es.cm.android.tabletBankia Tablet
es.evobanco.bancamovilEVO Banco móvil
es.lacaixa.mobile.android.newwapiconCaixaBank
eu.eleader.mobilebanking.investplusbank24
eu.eleader.mobilebanking.pekaoPekao24Makler
eu.eleader.mobilebanking.pekao.firmPekaoBiznes24
eu.eleader.mobilebanking.raiffeisenMobile Bank
eu.inmite.prj.kb.mobilbankMobilni Banka
eu.newfrontier.iBanking.mobile.Halk.RetailHalkbank Mobile App
eu.unicreditgroup.hvbapptanHVB Mobile B@nking
finansbank.enparaEnpara.com Cep Şubesi
finansbank.enpara.sirketimEnpara.com Şirketim Cep Şubesi
fr.axa.monaxaMon AXA
fr.banquepopulaire.cyberplusBanque Populaire
fr.creditagricole.androidappMa Banque
fr.laposte.lapostemobileLa Poste – Services Postaux
fr.laposte.lapostetabletLa Poste HD – Services Postaux
fr.lcl.android.customerareaMes Comptes – LCL
hdfcbank.hdfcquickbankHDFC Bank MobileBanking LITE
hk.com.hsbc.hsbchkmobilebankingHSBC HK Mobile Banking
hr.asseco.android.jimba.mUCI.roMobile Banking
in.co.bankofbaroda.mpassbookBaroda mPassbook
info.blockchain.merchantBlockchain Merchant
io.getdelta.androidDelta – Bitcoin & Cryptocurrency Portfolio Tracker
it.bnl.apps.bankingBNL
it.bnl.apps.enterprise.bnlpayBNL PAY
it.bpc.proconl.mbplusMB+
it.copergmps.rt.pf.android.sp.bmpsBanca MPS
it.gruppocariparma.nowbankingNowbanking
it.ingdirect.appING DIRECT Italia
it.nogood.containerUBI Banca
it.popso.SCRIGNOappSCRIGNOapp
it.secservizi.mobile.atime.bpaaVolksbank per tablet
it.volksbank.androidVolksbank · Banca Popolare
jp.co.aeonbank.android.passbookイオン銀行通帳アプリ かんたんログイン&残高・明細の確認
jp.co.netbk住信SBIネット銀行
jp.co.rakuten_bank.rakutenbank楽天銀行 -個人のお客様向けアプリ
jp.co.sevenbank.AppPassbookApp Bankbook
jp.co.smbc.direct三井住友銀行アプリ
jp.mufg.bk.applisp.app三菱UFJ銀行
me.doubledutch.hvdnz.cbnationalconference2016CB Conference 2018
mobi.societegenerale.mobile.lappliL’Appli Société Générale
mobile.santander.deSantander Mobile Banking
net.bnpparibas.mescomptesMes Comptes BNP Paribas
nl.asnbank.asnbankierenASN Mobiel Bankieren
nl.snsbank.mobielbetalenSNS Mobiel Betalen
nz.co.anz.android.mobilebankingANZ goMoney New Zealand
nz.co.asb.asbmobileASB Mobile Banking
nz.co.bnz.droidbankingBNZ Mobile
nz.co.kiwibank.mobileKiwibank Mobile Banking
nz.co.westpacWestpac One (NZ) Mobile Banking
org.banksa.bankBankSA Mobile Banking
org.bom.bankBank of Melbourne Mobile Banking
org.stgeorge.bankSt.George Mobile Banking
org.westpac.bankWestpac Mobile Banking
piuk.blockchain.androidBlockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum
pl.aliorbank.aibAlior Bank
pl.allegroAllegro
pl.bosbank.mobileBOŚBank24
pl.bphBusinessPro Lite
pl.bps.bankowoscmobilnaBPS Mobilnie
pl.bzwbk.bzwbk24Santander mobile
pl.bzwbk.ibiznes24iBiznes24 mobile
pl.bzwbk.mobile.tab.bzwbk24BZWBK24 mobile (tablet)
pl.ceneoCeneo – zakupy i promocje
pl.com.rossmann.centaurosRossmann PL
pl.fmbank.smartNest Bank
pl.ideabank.mobilebankingIdea Bank PL
pl.ing.mojeingMoje ING mobile
pl.ipko.mobileToken iPKO
pl.mbankmBank PL
pl.millennium.corpAppBank Millennium for Companies
pl.orange.mojeorangeMój Orange
pl.pkobp.ikoIKO
pl.pkobp.ipkobiznesiPKO biznes
posteitaliane.posteapp.apppostepayPostepay
ro.btrl.mobileBanca Transilvania
ru.alfabank.mobile.androidАльфа-Банк (Alfa-Bank)
ru.alfabank.oavdo.amcАльфа-Бизнес
ru.alfabank.senseSense от Альфа-Банка
ru.alfadirect.appAlfa-Direct
ru.bm.mbmВТБ Банк Москвы
ru.mwQIWI Wallet
ru.sberbank.mobileofficeСбербанк Бизнес Онлайн
ru.sberbank.sberbankirSberbank IR
ru.sberbank.spasiboСпасибо от Сбербанка
ru.sberbank_sbbolСбербанк Бизнес Онлайн
ru.sberbankmobileСбербанк Онлайн
ru.tcsbank.c2cCard 2 Card
ru.tinkoff.goabroadFSSP FNS Russia
ru.tinkoff.mgpTinkoff Play: apply for a card
ru.tinkoff.smeТинькофф Бизнес
ru.vtb24.mobilebanking.androidVTB-Online
sk.sporoapps.accountsÚčty
sk.sporoapps.skenerPlatby
src.com.idbiIDBI Bank GO Mobile
tr.com.hsbc.hsbcturkeyHSBC Turkey
tr.com.sekerbilisim.mbankŞEKER MOBİL ŞUBE
tr.com.tradesoft.tradingsystem.gtpmobile.halkHalk Trade
uk.co.bankofscotland.businessbankBank of Scotland Business Mobile Banking
uk.co.santander.businessUK.bbBusiness Banking
uk.co.santander.santanderUKSantander Mobile Banking
wit.android.bcpBankingApp.millenniumPLBank Millennium
wos.com.zebpayZebpay Calculator – Profit/Loss Management
zebpay.ApplicationZebpay Bitcoin and Cryptocurrency Exchange
aib.ibank.androidAIB Mobile
com.att.myWirelessmyAT&T
com.bbntBB&T PlanTrac Mobile
com.bestbuy.androidBest Buy
com.discoverfinancial.mobileDiscover Mobile
com.eastwest.mobileEastWest Mobile
com.fi6256.godoughCommercial Bank for Android
com.fi6543.godoughCommunity Bank NA Mobile
com.fi6665.godoughFifth District Mobile Banking
com.fi9228.godoughCNB Mobile Banking
com.fi9908.godoughFirst US Bank Anywhere Access
com.fuib.android.spot.onlinePUMB Online
com.idamobile.android.hcbМобильный банк – Хоум Кредит
com.ifs.banking.fiid1369Fulton Bank Mobile Banking
com.ifs.mobilebanking.fiid3919Associated Credit Union Mobile
com.jackhenry.rockvillebankctUnited Bank – Mobile Banking
com.jackhenry.washingtontrustbankwaWTB Mobile
com.jpm.sig.androidJ.P. Morgan Mobile
com.sterling.onepaySterling OnePay
com.svb.mobilebankingSVB Mobile Banking-Commercial
com.ukrsibbank.client.androidUKRSIB online
com.vkontakte.androidVK
com.vzw.hss.myverizonMy Verizon
logo.com.mbankingПСБ
org.usemployees.mobileU.S. Employees Credit Union
pinacleMobileiPhoneApp.androidPINACLE®
ru.alfabank.mobile.ua.androidAlfa-Mobile Ukraine
ru.avangardБанк Авангард
ru.rosbank.androidROSBANK Online
ru.simpls.brs2.mobbankМоб. банк Русский Стандарт
ru.simpls.mbrd.uiМТС Банк
ru.taxovichkof.androidTaxovichkoF: order a taxi in St Petersburg online
ua.aval.dbo.client.androidRaiffeisen Online Ukraine
ua.com.cs.ifobs.mobile.android.otpOTP Smart
ua.com.cs.ifobs.mobile.android.pivdPivdenny MyBank
ua.oschadbank.onlineОщад 24/7
ua.privatbank.ap24Privat24
xmr.org.freewallet.appMonero Wallet
com.ubercabUber
com.avito.androidОбъявления Авито: авто, работа, квартиры, вещи
com.instagram.androidInstagram
com.openbankБанк Открытие
com.twitter.androidTwitter
com.viber.voipViber Messenger
com.whatsappWhatsApp Messenger
org.telegram.messengerTelegram
ru.auto.araАвто.ру: купить и продать авто
ru.ok.androidOK
ru.rutaxi.vezetВезёт – заказ такси онлайн
ru.yandex.taxiYandex.Taxi Ride-Hailing Service
cb.ibankУБРиР
com.bifit.mobile.otpbankОТПбизнес
com.bifit.mobile.ubrrУБРиР Pro
com.bifit.mobile.zenitЗЕНИТ Бизнес
com.bssys.mbcphone.akbarsАК БАРС Мобильный для Бизнеса
com.bssys.mbcphone.mtsMTS Bank. Business Client
com.bssys.mbcphone.rsbankРС Бизнес Онлайн
com.bssys.mbcphone.ubrirУБРиР Light
com.bssys.mbcphone.vostochnyВосточный Корпоративный
com.citibank.mobile.ruCitibank RU
com.isimplelab.ibank.kazanБанк Казани
com.isimplelab.isimpleceo.kazanБК Бизнес
com.isimplelab.isimpleceo.minbМИнБанк Бизнес
cz.bsc.rcРенессанс Кредит
ru.akbars.mobileАк Барс Онлайн 3.0
ru.avangard.legalАвангард Бизнес
ru.bankuralsib.mb.androidМобильный банк УРАЛСИБ
ru.beeline.cardКарта Билайн
ru.bspbBSPB Mobile
ru.ftc.faktura.expressbankВосточный мобайл
ru.gazprombank.android.mobilebank.appТелекард 2.0
ru.kykyryzaКукуруза
ru.mdm.appБинбанк Бизнес
ru.minbank.androidМИнБ
ru.mkb.businessМКБ Бизнес
ru.mkb.mobileМКБ Мобайл
ru.otpbankОТПкредит
ru.psbank.msb.dev.psb_appstorePSB Мой Бизнес
ru.raiffeisen.android.rboРайффайзен Бизнес
ru.raiffeisennewsRaiffeisen Online Russia
ru.rocketbank.r2d2Рокетбанк
ru.rshb.dboМобильный банк, Россельхозбанк
ru.rshb.dboulРоссельхозбанк Бизнес-Онлайн
ru.skbbank.ibСКБ Онлайн
ru.skbbank.ibankСКБ-банк
ru.stepup.MDMmobileBankБинбанк online 2.0
ru.ucb.androidMobile.UniCredit
ru.vtb24.biz.client.androidВТБ Бизнес Онлайн
ru.zenit.androidЗЕНИТ Онлайн 2.0
de.ingdiba.bankingappING-DiBa Banking to go
btc.org.freewallet.appBitcoin Wallet by Freewallet
com.alibaba.aliexpresshdAliExpress – Smarter Shopping, Better Living
com.bitcoin.mwalletBitcoin Wallet
com.bitpay.walletBitPay – Secure Bitcoin Wallet
com.blocktrail.mywalletBTC.com – Bitcoin Wallet
com.bookingBooking.com Travel Deals
com.electroneum.mobileElectroneum
com.gettaxi.androidGett
com.google.android.play.gamesGoogle Play Games
com.samsung.android.spaySamsung Pay
io.totalcoin.walletBitcoin Wallet Totalcoin – Buy and Sell Bitcoin
ru.aviasalesAviasales — авиабилеты дешево
ru.tutu.tutu_empTutu.ru – flights, Russian railway and bus tickets
ru.yandex.moneyYandex.Money—wallet, cards, transfers, and fines
com.google.android.apps.walletnfcrelGoogle Pay

总结

Anubis自爆发以来,其主要活动区域在欧美等地,虽然目前国内暂时没有发现此类银行木马,但其代码字符串混淆中,含有中文混淆方案,所以依然值得我们警惕。

Anubis主要以渗透进入谷歌商店为主要传播平台,木马本身以仿冒金融机构、主流应用程序、浏览器插件为主要伪装手段。

Anubis是结合了钓鱼、远控、勒索等功能的银行木马,其功能强大到甚至可以作为一款间谍软件的存在。虽然谷歌商店一直在清理相关恶意木马,但仍然有残留的软件在活跃,此次西班牙发现Anubis通过仿冒邮政运营商Correos进行传播,也说明了Anubis一直都在并没有消失,而且其数量也并没有减少,所以我们依然要对Anubis木马提高警惕,我们也会时刻关注Anubis最新变种的出现。

IOC

MD5
3D3EC2C2F81FE4EE582DCA2E69752EE1
04D94228021B73E44261ADCCAD4173F3
D2C8F0D197A14EEFBDB9643DDB898477
e5141d3f2a3bd6ecf64089401b015f0c
1e8870eb6f141df9b8d9f4dd295188be
d045e6d5c9b493dbe35aa4cb94652072
e6ab7d099bd4f01eca83075c55eb94e1
9c7187266b2c881570cdf69af714252b
0943a47985a0b33018877676cfef6c47
6bb24ad97a777a6ced82199fa3d2e656
3590baefdcf54c69e0a363b8adaf74b9
7b7f0041263f4a6bf3d648e19e8f5201
02dd7a6fb1fc0587bdd85cc267c733a4
390674bdb17d77c9b32bd7780a176f4c
4fbeaa50b11bf58418efc8ee9eb1e2aa
93f3c95243b347f446a54ce219307bec
0ff2626fe3a449ba0ee97e68d87c9249
7ebe35cbf1eff3702f06e54a432e6f39
a519c9d681a76702cd5827a428e2fbdc
5425eb81ac515a2ee169cf748b00badb
6d15674a905941be2675ec1b4c658d94
35967f792d7f0e0fad821a34e720731e
0135026d9f4fb41466e44abcb3e03752
dc4db1997889d2aeea18e60ee6d0f9e4
17091e2d6af45fc65c46c4a5d9a54de2
53035f67f5f07bf39856f02589727b30
bcb2f691e6291e80f97dcdbece8bef4f
fb6ee9be6feaf5784e9f6ab3f8751b07
6c8e24bb040abe91f99f0624eba68615
e29f8dbba94d6402d03d06c8308dcd03
ac0e66262d431a170f2ab9cef2a96dd1
ba5daf527a6efcc8223812961267960c
df98cd6a1200a8f51791b2f06aabad88
68c72bdd2c3289613a0b649c5f67c066
028336c0f5360d9c635ff0ecc6a6b528
659aebc9b8e9a6f447ef6343893643c6
91b7f1fa55cf08adee79116d76bf4dc4
01bc9a13dd0b091b2ddce9ee2e682c0c
fd5010347cd2157604caa990f1454800
ae0bd650536ac6dcc1e98978293e5926
aa8202f424ad998c36c4b91d7db2a5ec
C778267F160B97CBB4A970F837C61FF9
dfeae0b92e2addac132ce0a941bc9651
c1419376bfbd84b94b1547003706e89d
a8b8eb22302139a0a76b8ff16bb589c6
C&C
hxxps://twitter.com/wadaishere5
hxxps://twitter.com/wadaishere11
hxxps://twitter.com/scotyhall
hxxps://twitter.com/ruyas_s
hxxps://twitter.com/qweqweqwe
hxxps://twitter.com/PelinSN10495193
hxxps://twitter.com/mrzabibus
hxxps://twitter.com/force19994
hxxps://twitter.com/Donald19532
hxxps://twitter.com/Alexey31405753
hxxps://t.me/appqltkjsaa
hxxps://nasistemeafk.sc.ug
hxxps://188dyz.com/sett
hxxp://wadascx1wesa.club/admin_panel
hxxp://wadaishere.tk/admin_panel
hxxp://translationutility.tk
hxxp://services32.website
hxxp://schvhost.us
hxxp://sasaz.ru
hxxp://mining.ltd.ua
hxxp://colbrte.top
hxxp://batikantognas.com.tr
hxxp://aktivierung-342675-deustchland-services.ru
hxxp://45.76.42.67
hxxp://185.254.121.24
hxxp://185.235.128.44
hxxp://185.139.70.135
hxxp://181.174.166.106
87600.ooo
12313.ooo

参考信息

https://info.phishlabs.com/blog/new-variant-bankbot-banking-trojan-aubis

https://www.threatfabric.com/blogs/anubis_2_malware_and_afterlife.html