背景介绍

Anubis(阿努比斯)是古埃及神话中的死神,以胡狼头、人身的形象出现在法老的壁画中。同时Anubis也是一种Android银行恶意软件,自2017年以来已经为全球100多个国家,300多家金融机构带来了相当大的麻烦。Anubis截止到目前为止,爆发地主要为欧洲国家,国内暂未发现该银行木马。

Anubis主要通过伪装成金融应用、手机游戏、购物应用、软件更新、邮件应用、浏览器应用甚至物流应用等,从而渗透进谷歌应用商店,诱骗用户下载安装。

Anubis木马功能强大,自身结合了钓鱼、远控、勒索木马的功能。Anubis通过仿冒各种应用诱骗用户安装使用,当软件被激活后,会展现给用户一个仿冒的钓鱼页面,从而获取用户敏感信息,如银行账号密码、个人身份信息等。Anubis具备一般银行木马的功能,包括屏蔽用户短信,获取转发用户短信等功能。Anubis同时可以从服务端获取远控指令,对用户手机进行进一步控制。Anubis还是第一个集成勒索软件功能的Android银行木马。Anubis功能之多、之强大,甚至可以作为间谍软件进行使用。

近期有国外安全研究者发现一款仿冒为西班牙邮政运营商Correos的恶意软件,该恶意软件运行后会释放仿冒为Google Play Service Updater V2.1的Anubis木马程序,诱骗用户安装更新。

诱饵关联

本次Anubis的载体为仿冒为西班牙邮政运营商Correos的恶意软件:

Correos官网:

经过盘古团队的Janus系统关联分析,我们发现了最新的12个Anubis载体,其图标去重后如下:

本次Anubis载体代码结构也基本相同:

样本分析

样本基本信息

文件名称

Correos Rastreo.apk

软件名称

Correos Rastreo

软件包名

com.consultar.rastero

MD5

04D94228021B73E44261ADCCAD4173F3

安装图标

Anubis银行木马到目前为止功能大同小异,虽然仿冒的种类繁多,但核心代码结构并未有巨大的改变。Anubis代码核心以远控为主体,钓鱼、勒索等其它功能为辐,目的则为获取用户关键信息,窃取用户财产。

仿冒为Correos的程序运行后,会诱骗用户安装更新GooglePlay,而该更新软件即为Anubis木马程序。

仿冒为Correos的样本运行界面:

诱骗用户安装仿冒为Google Play Service Updater V2.1的Anubis木马程序:

通过拼接字符串获取下载链接:

访问数据:

获取到的Anubis木马程序:

当Anubis木马运行后,依然延续了恶意软件的“做贼心虚”的本质,先隐藏自身,达到保护自身的目的:

通过服务器可以下发30多种指令,获取对用户手机的全面控制权,其中主要功能有,获取键盘记录、加密用户手机文件、开启VNC远程、打开指定web界面等。

获取指令及上传获取到的用户信息的URL拼接:

主要远控指令分析

主要远控指令

指令对应的功能

Send_GO_SMS

向指定电话号码发送指定内容

nymBePsG0

获取用户手机通讯录

GetSWSGO

获取用户手机短信

|telbookgotext=

获取用户手机通讯录

getapps

获取用户手机已安装应用

getpermissions

获取已有的权限信息

startaccessibility

权限请求

startpermission

权限请求

=ALERT|

提示消息

=PUSH|

推送通知

startAutoPush

根据不同国家,推送不同的消息

RequestPermissionGPS

请求获取地理位置权限

|ussd=

呼叫转移

|recordsound=

录音

|replaceurl=

替换URL

|startapplication=

启动指定应用

getkeylogger

获取键盘记录

stopsound

停止录音

startsound

开始录音

startscreenVNC

开启VNC远控

deletefilefolder:

删除文件

downloadfile:

下载文件

opendir:

获取文件路径

startforward=

启动呼叫转移功能到指定号码

stopforward

停止呼叫转移功能

|openbrowser=

打开浏览器

|openactivity=

启动ActivityURL,打开一个web页面

|cryptokey=

对用户手机对应文件进行加密操作

|decryptokey=

对用户手机对应文件进行解密操作

getip

获取用户IP地址

指令 “Send_GO_SMS”:向指定电话号码发送指定内容。

指令 “nymBePsG0”:获取用户手机通讯录。

指令 “GetSWSGO”:获取用户手机短信。

指令 “|telbookgotext=”:获取用户手机通讯录。

指令 “getapps”:获取用户手机已安装应用。

指令 “getpermissions”:获取已有的权限信息。

指令 “startaccessibility”:权限请求。

指令 “startpermission”:权限请求。

指令 “=ALERT|”:提示消息。

指令 “=PUSH|”:推送通知。

指令 “startAutoPush”:根据不同国家,推送不同的消息。

指令 “RequestPermissionGPS”:请求获取地理位置权限。

指令 “|ussd=”:呼叫转移。

指令 “|recordsound=”:录音。

指令 “|replaceurl=”:替换URL。

指令 “|startapplication=”:启动指定应用。

指令 “getkeylogger”:获取键盘记录。

指令 “stopsound”:停止录音。

指令 “startsound”:开始录音。

指令 “startscreenVNC”:开启VNC远控。

指令”deletefilefolder:”:删除文件。

指令 “downloadfile:”:下载文件。

指令 “opendir:”:获取文件路径。

指令 “startforward=”:启动呼叫转移功能到指定号码。

指令 “stopforward”:停止呼叫转移功能。

指令 “|openbrowser=”:打开浏览器。

指令 “|openactivity=”:启动ActivityURL,打开一个web页面。

指令 “|cryptokey=”:对用户手机对应文件进行加密操作。

指令 “|decryptokey=”:对用户手机对应文件进行解密操作。

指令 “getip”:获取用户IP地址。

同源分析

通过分析样本远控代码,我们可以发现其功能繁多且全面,对应不同的指令功能,我们不难理解整个木马的运作流程及各个功能的目的。值得注意的是,木马有打开WEB页面的操作,虽然目前该URL已经失效,但我们结合之前的同源样本分析结果,可以发现要打开的URL即为钓鱼页面。

同源样本中,打开推特链接:

现已失效:

同源样本中之前国外的分析结果,打开推特获取备份C2:

打开解析后的链接,即为仿冒银行的登录页面:

新发现的Anubis相比于以前的做了加固处理,但是脱壳之后代码结构与之前的没有多大改变。

经过加固的代码结构:

脱壳后的代码结构:

Anubis旧版本代码结构:

新近活动

我们对2019年后的Anubis样本进行了数据统计,以便后期可以更好的进行监控。

统计Anubis仿冒的主要图标,我们可以发现,Anubis木马主要通过仿冒一些主流的应用或者浏览器插件,诱骗用户进行更新,从而可以最大限度的迷惑用户,使木马本身可以顺利安装到用户手机中。

通过统计2019年前4个月Anubis数量变化,我们可以发现,Anubis并没有因去年在国外大规模的爆发,被谷歌进行清理封杀而彻底消失或数量减少,其仍然一直存活着而且数量并没有减少,不间断的仍然会有人中木马病毒,虽然其域名被大量封杀,但并不能说明Anubis对用户手机已没有任何威胁,我们依然要谨防新的变种出现。

通过统计主要受害国家,我们可以看到受害国家主要集中在欧美地区,而土耳其与美国受害者最多,虽然目前国内暂未发现Anubis木马病毒,但我们也不能大意:

此外附上由Threatfabric总结的,Anubis自爆发以来仿冒全球378个金融机构应用程序信息:

Package name

Application name

MyING.be

ING Smart Banking

alior.bankingapp.android

Usługi Bankowe

at.bawag.mbanking

BAWAG P.S.K.

at.easybank.mbanking

easybank

at.easybank.securityapp

easybank Security App

at.easybank.tablet

easybank app

at.psa.app.bawag

BAWAG P.S.K. SmartPay

at.spardat.bcrmobile

Touch 24 Banking BCR

at.spardat.netbanking

ErsteBank/Sparkasse netbanking

at.volksbank.volksbankmobile

Volksbank Banking

au.com.bankwest.mobile

Bankwest

au.com.cua.mb

CUA

au.com.ingdirect.android

ING Australia Banking

au.com.mebank.banking

ME Bank

au.com.nab.mobile

NAB Mobile Banking

au.com.newcastlepermanent

NPBS Mobile Banking

au.com.suncorp.SuncorpBank

Suncorp Bank

biz.mobinex.android.apps.cep_sifrematik

Garanti Cep Şifrematik

by.st.alfa

Альфа-Бизнес Мобайл Беларусь

com.DijitalSahne.EnYakinHalkbank

Halkbank Nerede

com.FubonMobileClient

Fubon HK

com.MobileTreeApp

Dah Sing Bank

com.Plus500

Plus500: CFD Online Trading on Forex and Stocks

com.SifrebazCep

Halkbank Şifrebaz Cep

com.abnamro.nl.mobile.payments

ABN AMRO Mobiel Bankieren

com.advantage.RaiffeisenBank

Raiffeisen Smart Mobile

com.aff.otpdirekt

OTP SmartBank

com.akbank.android.apps.akbank_direkt

Akbank Direkt

com.akbank.android.apps.akbank_direkt_tablet

Akbank Direkt Tablet

com.akbank.softotp

Akbank Direkt Şifreci

com.amazon.mShop.android.shopping

Amazon Shopping

com.amazon.windowshop

Amazon for Tablets

com.anz.android

ANZ Mobile Taiwan

com.anz.android.gomoney

ANZ Australia

com.anzspot.mobile

ANZ Spot

com.arubanetworks.atmanz

Atmosphere ANZ

com.axis.mobile

Axis Mobile- Fund Transfer,UPI,Recharge & Payment

com.bankaustria.android.olb

Bank Austria MobileBanking

com.bankia.wallet

Bankia Wallet

com.bankinter.launcher

Bankinter Móvil

com.bankofamerica.cashpromobile

CashPro® + Token

com.bankofqueensland.boq

BOQ Mobile

com.barclays.android.barclaysmobilebanking

Barclays Mobile Banking

com.barclays.ke.mobile.android.ui

Barclays Kenya

com.bawagpsk.securityapp

BAWAG P.S.K. Security App

com.bbva.bbvacontigo

BBVA Spain

com.bbva.bbvawallet

BBVA Wallet Spain. Mobile Payment

com.bbva.netcash

BBVA Net cash | ES & PT

com.bendigobank.mobile

Bendigo Bank

com.binance.dev

Binance - Cryptocurrency Exchange

com.binance.odapplications

Binance: Cryptocurrency & Bitcoin Exchange

com.bitcoin.ss.zebpayindia

Zebpay India

com.bitfinex.bfxapp

Bitfinex

com.bitmarket.trader

Aplikacja Bitmarket

com.blockfolio.blockfolio

Blockfolio - Bitcoin and Cryptocurrency Tracker

com.bmo.mobile

BMO Mobile Banking

com.boursorama.android.clients

Boursorama Banque

com.bssys.VTBClient

Mobile Client VTB

com.bssys.vtb.mobileclient

MobileClientVTB

com.btcturk

BtcTurk Bitcoin Borsası

com.caisseepargne.android.mobilebanking

Banque

com.cba.android.netbank

CommBank app for tablet

com.chase.sig.android

Chase Mobile

com.cibc.android.mobi

CIBC Mobile Banking®

com.citi.citimobile

Citi Mobile®

com.citibank.mobile.au

Citibank Australia

com.citibank.mobile.uk

Citi Mobile UK

com.clairmail.fth

Fifth Third Mobile Banking

com.cleverlance.csas.servis24

SERVIS 24 Mobilni banka

com.cm_prod.bad

Crédit Mutuel

com.cm_prod.epasal

Epargne Salariale CM

com.cm_prod.nosactus

Crédit Mutuel - Nos Actus

com.cm_prod_tablet.bad

Crédit Mutuel pour Tablettes

com.coin.profit

Coin Profit

com.coinbase.android

Coinbase - Buy Bitcoin & more. Secure Wallet.

com.coins.bit.local

LocalBitCoins

com.coins.ful.bit

LocalBitCoins NEW

com.comarch.mobile.banking.bgzbnpparibas.biznes

Mobile BiznesPl@net

com.comarch.security.mobilebanking

INGBusiness

com.commbank.netbank

CommBank

com.crowdcompass.appSQ0QACAcYJ

ANZ Investor Tour

com.crypter.cryptocyrrency

Crypto App - Widgets, Alerts, News, Bitcoin Prices

com.csam.icici.bank.imobile

iMobile by ICICI Bank

com.db.mm.deutschebank

Meine Bank

com.db.mm.norisbank

norisbank App

com.db.pwcc.dbmobile

Deutsche Bank Mobile

com.dbs.hk.dbsmbanking

DBS digibank Hong Kong

com.de.dkb.portalapp

DKB-Banking

com.ebay.mobile

Fashion & Tech Deals - Shop, Sell & Save with eBay

com.edsoftapps.mycoinsvalue

My CryptoCoins Portfolio - All Coins

com.empik.empikapp

Empik

com.empik.empikfoto

Empik Foto

com.entersekt.authapp.sparkasse

S-ID-Check

com.fi6122.godough

TSB Mobile

com.finansbank.mobile.cepsube

QNB Finansbank Cep Şubesi

com.finanteq.finance.ca

CA24 Mobile

com.fragment.akbank

Akbank Sanat

com.fusion.ATMLocator

People"s Choice Credit Union

com.garanti.cepbank

Garanti CepBank

com.garanti.cepsubesi

Garanti Mobile Banking

com.garantibank.cepsubesiro

GarantiBank

com.garantiyatirim.fx

Garanti FX Trader

com.getingroup.mobilebanking

Getin Mobile

com.grppl.android.shell.BOS

Bank of Scotland Mobile Banking: secure on the go

com.grppl.android.shell.CMBlloydsTSB73

Lloyds Bank Mobile Banking

com.grppl.android.shell.halifax

Halifax: the banking app that gives you extra

com.hangseng.rbmobile

Hang Seng Personal Banking

com.htsu.hsbcpersonalbanking

HSBC Mobile Banking

com.idamob.tinkoff.android

Tinkoff

com.idbi.mpassbook

IDBI Bank mPassbook

com.idbibank.abhay_card

Abhay by IDBI Bank Ltd

com.ideomobile.hapoalim

בנק הפועלים - ניהול החשבון‎

com.ifs.banking.fiid4202

TSBBank Mobile Banking

com.imb.banking2

IMB.Banking

com.infonow.bofa

Bank of America Mobile Banking

com.infrasofttech.indianBank

IndPay

com.ing.diba.mbbr2

ING-DiBa Banking + Brokerage

com.ing.mobile

ING Bankieren

com.ingbanktr.ingmobil

ING Mobil

com.isis_papyrus.raiffeisen_pay_eyewdg

Raiffeisen ELBA

com.jackpf.blockchainsearch

Bitcoin Blockchain Explorer

com.jamalabbasii1998.localbitcoin

Local BitCoin

com.jiffyondemand.user

Jiffy

com.konylabs.capitalone

Capital One® Mobile

com.kryptokit.jaxx

Jaxx Blockchain Wallet

com.kutxabank.android

Kutxabank

com.kuveytturk.mobil

Mobil Şube

com.latuabanca_tabperandroid

La tua banca per Tablet

com.latuabancaperandroid

Intesa Sanpaolo Mobile

com.localbitcoins.exchange

LocalBitcoins - Buy and sell Bitcoin

com.localbitcoinsmbapp

LocalBitCoins Official

com.lynxspa.bancopopolare

YouApp

com.magiclick.FinansPOS

FinansPOS

com.magiclick.odeabank

Odeabank

com.mal.saul.coinmarketcap

Coin Market-Bitcoin Prices,Currencies,BTC,EUR,ICO

com.matriksdata.finansyatirim

QNB Finansinvest

com.matriksdata.ziraatyatirim.pad

Ziraat Trader HD

com.matriksmobile.android.ziraatTrader

Ziraat Trader

com.mobikwik_new

Mobile Recharge,Bill Payments,UPI & Money Transfer

com.mobillium.papara

Papara Cüzdan

com.moneybookers.skrillpayments

Skrill

com.moneybookers.skrillpayments.neteller

NETELLER

com.monitise.isbankmoscow

ISBANK Online

com.mtel.androidbea

BEA 東亞銀行

com.mycelium.wallet

Mycelium Bitcoin Wallet

com.oxigen.oxigenwallet

Bill Payment & Recharge,Wallet

com.palatine.android.mobilebanking.prod

ePalatine Particuliers

com.paypal.android.p2pmobile

PayPal Cash App: Send and Request Money Fast

com.phyder.engage

RBS

com.plunien.poloniex

Poloniex

com.portfolio.coinbase_tracker

Coinbase Tracker (3rd party)

com.pozitron.albarakaturk

Albaraka Mobil Şube

com.pozitron.iscep

İşCep

com.pozitron.vakifbank

VakıfBank Cep Şifre

com.quickmobile.anzirevents15

ANZ Investor Relations Events

com.rbc.mobile.android

RBC Mobile

com.rbs.mobile.android.natwest

NatWest Mobile Banking

com.rbs.mobile.android.natwestbandc

NatWest Business Banking

com.rbs.mobile.android.natwestoffshore

NatWest International

com.rbs.mobile.android.rbs

Royal Bank of Scotland Mobile Banking

com.rbs.mobile.android.rbsbandc

RBS Business Banking

com.rbs.mobile.android.ubr

Ulster Bank RI Mobile Banking

com.rbs.mobile.investisir

RBS Investor & Media Relations

com.redrockdigimark

QNB National Day

com.rsi

ruralvía

com.santander.app

Santander Brasil

com.sbi.SBIFreedomPlus

SBI Anywhere Personal

com.scb.breezebanking.hk

SC Mobile Hong Kong

com.scotiabank.mobile

Scotiabank Mobile Banking

com.snapwork.IDBI

IDBI Bank GO Mobile+

com.snapwork.hdfc

HDFC Bank MobileBanking

com.softtech.isbankasi

İşTablet

com.softtech.iscek

ÇEKSOR

com.sovereign.santander

Santander Bank US

com.starfinanz.mobile.android.pushtan

S-pushTAN

com.starfinanz.smob.android.sbanking

Sparkasse+ Finanzen im Griff

com.starfinanz.smob.android.sfinanzstatus

Sparkasse Ihre mobile Filiale

com.starfinanz.smob.android.sfinanzstatus.tablet

Sparkasse fürs Tablet

com.suntrust.mobilebanking

SunTrust Mobile App

com.targo_prod.bad

TARGOBANK Mobile Banking

com.td

TD Canada

com.teb

CEPTETEB

com.tecnocom.cajalaboral

Banca Móvil Laboral Kutxa

com.thunkable.android.manirana54.LocalBitCoins

LocalBitCoins

com.thunkable.android.manirana54.LocalBitCoins_unblock

UNBLOCK Local BitCoins

com.thunkable.android.santoshmehta364.UNOCOIN_LIVE

UNOCOIN LIVE

com.tmob.denizbank

MobilDeniz

com.tmob.tabletdeniz

MobilDeniz Tablet

com.tmobtech.halkbank

Halkbank Mobil

com.tnx.apps.coinportfolio

Coin Portfolio for Bitcoin & Altcoin tracker

com.triodos.bankingnl

Triodos Bankieren NL

com.unicredit

Mobile Banking UniCredit

com.unionbank.ecommerce.mobile.android

Union Bank Mobile Banking

com.unionbank.ecommerce.mobile.commercial.legacy

Union Bank Commercial Clients

com.unocoin.unocoinmerchantPoS

Unocoin Merchant PoS

com.unocoin.unocoinwallet

Unocoin Wallet

com.usaa.mobile.android.usaa

USAA Mobile

com.usbank.mobilebanking

U.S. Bank

com.vakifbank.mobile

VakıfBank Mobil Bankacılık

com.veripark.ykbaz

YapıKredi Azərbaycan MobilBank

com.vipera.ts.starter.QNB

QNB Mobile

com.vtb.mobilebank

VTB Mobile Georgia

com.wellsFargo.ceomobile

Wells Fargo CEO Mobile®

com.wf.wellsfargomobile

Wells Fargo Mobile

com.wf.wellsfargomobile.tablet

Wells Fargo for Tablet

com.yinzcam.facilities.verizon

Capital One Arena Mobile

com.ykb.android

Yapı Kredi Mobile

com.ykb.android.mobilonay

Yapı Kredi Corporate-For Firms

com.ykb.androidtablet

Yapı Kredi Mobil Şube

com.ykb.avm

Yapı Kredi Cüzdan

com.yurtdisi.iscep

JSC İŞBANK

com.ziraat.ziraatmobil

Ziraat Mobil

com.ziraat.ziraattablet

Ziraat Tablet

cz.airbank.android

My Air

cz.csob.smartbanking

ČSOB SmartBanking

cz.sberbankcz

Smart Banking

de.comdirect.android

comdirect mobile App

de.commerzbanking.mobil

Commerzbank Banking App

de.consorsbank

Consorsbank

de.dkb.portalapp

DKB-Banking

de.fiducia.smartphone.android.banking.vr

VR-Banking

de.fiducia.smartphone.android.securego.vr

VR-SecureGo

de.postbank.finanzassistent

Postbank Finanzassistent

de.schildbach.wallet

Bitcoin Wallet

es.bancopopular.nbmpopular

Popular

es.bancosantander.apps

Santander

es.cm.android

Bankia

es.cm.android.tablet

Bankia Tablet

es.evobanco.bancamovil

EVO Banco móvil

es.lacaixa.mobile.android.newwapicon

CaixaBank

eu.eleader.mobilebanking.invest

plusbank24

eu.eleader.mobilebanking.pekao

Pekao24Makler

eu.eleader.mobilebanking.pekao.firm

PekaoBiznes24

eu.eleader.mobilebanking.raiffeisen

Mobile Bank

eu.inmite.prj.kb.mobilbank

Mobilni Banka

eu.newfrontier.iBanking.mobile.Halk.Retail

Halkbank Mobile App

eu.unicreditgroup.hvbapptan

HVB Mobile B@nking

finansbank.enpara

Enpara.com Cep Şubesi

finansbank.enpara.sirketim

Enpara.com Şirketim Cep Şubesi

fr.axa.monaxa

Mon AXA

fr.banquepopulaire.cyberplus

Banque Populaire

fr.creditagricole.androidapp

Ma Banque

fr.laposte.lapostemobile

La Poste - Services Postaux

fr.laposte.lapostetablet

La Poste HD - Services Postaux

fr.lcl.android.customerarea

Mes Comptes - LCL

hdfcbank.hdfcquickbank

HDFC Bank MobileBanking LITE

hk.com.hsbc.hsbchkmobilebanking

HSBC HK Mobile Banking

hr.asseco.android.jimba.mUCI.ro

Mobile Banking

in.co.bankofbaroda.mpassbook

Baroda mPassbook

info.blockchain.merchant

Blockchain Merchant

io.getdelta.android

Delta - Bitcoin & Cryptocurrency Portfolio Tracker

it.bnl.apps.banking

BNL

it.bnl.apps.enterprise.bnlpay

BNL PAY

it.bpc.proconl.mbplus

MB+

it.copergmps.rt.pf.android.sp.bmps

Banca MPS

it.gruppocariparma.nowbanking

Nowbanking

it.ingdirect.app

ING DIRECT Italia

it.nogood.container

UBI Banca

it.popso.SCRIGNOapp

SCRIGNOapp

it.secservizi.mobile.atime.bpaa

Volksbank per tablet

it.volksbank.android

Volksbank · Banca Popolare

jp.co.aeonbank.android.passbook

イオン銀行通帳アプリ かんたんログイン&残高・明細の確認

jp.co.netbk

住信SBIネット銀行

jp.co.rakuten_bank.rakutenbank

楽天銀行 -個人のお客様向けアプリ

jp.co.sevenbank.AppPassbook

App Bankbook

jp.co.smbc.direct

三井住友銀行アプリ

jp.mufg.bk.applisp.app

三菱UFJ銀行

me.doubledutch.hvdnz.cbnationalconference2016

CB Conference 2018

mobi.societegenerale.mobile.lappli

L"Appli Société Générale

mobile.santander.de

Santander Mobile Banking

net.bnpparibas.mescomptes

Mes Comptes BNP Paribas

nl.asnbank.asnbankieren

ASN Mobiel Bankieren

nl.snsbank.mobielbetalen

SNS Mobiel Betalen

nz.co.anz.android.mobilebanking

ANZ goMoney New Zealand

nz.co.asb.asbmobile

ASB Mobile Banking

nz.co.bnz.droidbanking

BNZ Mobile

nz.co.kiwibank.mobile

Kiwibank Mobile Banking

nz.co.westpac

Westpac One (NZ) Mobile Banking

org.banksa.bank

BankSA Mobile Banking

org.bom.bank

Bank of Melbourne Mobile Banking

org.stgeorge.bank

St.George Mobile Banking

org.westpac.bank

Westpac Mobile Banking

piuk.blockchain.android

Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum

pl.aliorbank.aib

Alior Bank

pl.allegro

Allegro

pl.bosbank.mobile

BOŚBank24

pl.bph

BusinessPro Lite

pl.bps.bankowoscmobilna

BPS Mobilnie

pl.bzwbk.bzwbk24

Santander mobile

pl.bzwbk.ibiznes24

iBiznes24 mobile

pl.bzwbk.mobile.tab.bzwbk24

BZWBK24 mobile (tablet)

pl.ceneo

Ceneo - zakupy i promocje

pl.com.rossmann.centauros

Rossmann PL

pl.fmbank.smart

Nest Bank

pl.ideabank.mobilebanking

Idea Bank PL

pl.ing.mojeing

Moje ING mobile

pl.ipko.mobile

Token iPKO

pl.mbank

mBank PL

pl.millennium.corpApp

Bank Millennium for Companies

pl.orange.mojeorange

Mój Orange

pl.pkobp.iko

IKO

pl.pkobp.ipkobiznes

iPKO biznes

posteitaliane.posteapp.apppostepay

Postepay

ro.btrl.mobile

Banca Transilvania

ru.alfabank.mobile.android

Альфа-Банк (Alfa-Bank)

ru.alfabank.oavdo.amc

Альфа-Бизнес

ru.alfabank.sense

Sense от Альфа-Банка

ru.alfadirect.app

Alfa-Direct

ru.bm.mbm

ВТБ Банк Москвы

ru.mw

QIWI Wallet

ru.sberbank.mobileoffice

Сбербанк Бизнес Онлайн

ru.sberbank.sberbankir

Sberbank IR

ru.sberbank.spasibo

Спасибо от Сбербанка

ru.sberbank_sbbol

Сбербанк Бизнес Онлайн

ru.sberbankmobile

Сбербанк Онлайн

ru.tcsbank.c2c

Card 2 Card

ru.tinkoff.goabroad

FSSP FNS Russia

ru.tinkoff.mgp

Tinkoff Play: apply for a card

ru.tinkoff.sme

Тинькофф Бизнес

ru.vtb24.mobilebanking.android

VTB-Online

sk.sporoapps.accounts

Účty

sk.sporoapps.skener

Platby

src.com.idbi

IDBI Bank GO Mobile

tr.com.hsbc.hsbcturkey

HSBC Turkey

tr.com.sekerbilisim.mbank

ŞEKER MOBİL ŞUBE

tr.com.tradesoft.tradingsystem.gtpmobile.halk

Halk Trade

uk.co.bankofscotland.businessbank

Bank of Scotland Business Mobile Banking

uk.co.santander.businessUK.bb

Business Banking

uk.co.santander.santanderUK

Santander Mobile Banking

wit.android.bcpBankingApp.millenniumPL

Bank Millennium

wos.com.zebpay

Zebpay Calculator - Profit/Loss Management

zebpay.Application

Zebpay Bitcoin and Cryptocurrency Exchange

aib.ibank.android

AIB Mobile

com.att.myWireless

myAT&T

com.bbnt

BB&T PlanTrac Mobile

com.bestbuy.android

Best Buy

com.discoverfinancial.mobile

Discover Mobile

com.eastwest.mobile

EastWest Mobile

com.fi6256.godough

Commercial Bank for Android

com.fi6543.godough

Community Bank NA Mobile

com.fi6665.godough

Fifth District Mobile Banking

com.fi9228.godough

CNB Mobile Banking

com.fi9908.godough

First US Bank Anywhere Access

com.fuib.android.spot.online

PUMB Online

com.idamobile.android.hcb

Мобильный банк - Хоум Кредит

com.ifs.banking.fiid1369

Fulton Bank Mobile Banking

com.ifs.mobilebanking.fiid3919

Associated Credit Union Mobile

com.jackhenry.rockvillebankct

United Bank - Mobile Banking

com.jackhenry.washingtontrustbankwa

WTB Mobile

com.jpm.sig.android

J.P. Morgan Mobile

com.sterling.onepay

Sterling OnePay

com.svb.mobilebanking

SVB Mobile Banking-Commercial

com.ukrsibbank.client.android

UKRSIB online

com.vkontakte.android

VK

com.vzw.hss.myverizon

My Verizon

logo.com.mbanking

ПСБ

org.usemployees.mobile

U.S. Employees Credit Union

pinacleMobileiPhoneApp.android

PINACLE®

ru.alfabank.mobile.ua.android

Alfa-Mobile Ukraine

ru.avangard

Банк Авангард

ru.rosbank.android

ROSBANK Online

ru.simpls.brs2.mobbank

Моб. банк Русский Стандарт

ru.simpls.mbrd.ui

МТС Банк

ru.taxovichkof.android

TaxovichkoF: order a taxi in St Petersburg online

ua.aval.dbo.client.android

Raiffeisen Online Ukraine

ua.com.cs.ifobs.mobile.android.otp

OTP Smart

ua.com.cs.ifobs.mobile.android.pivd

Pivdenny MyBank

ua.oschadbank.online

Ощад 24/7

ua.privatbank.ap24

Privat24

xmr.org.freewallet.app

Monero Wallet

com.ubercab

Uber

com.avito.android

Объявления Авито: авто, работа, квартиры, вещи

com.instagram.android

Instagram

com.openbank

Банк Открытие

com.twitter.android

Twitter

com.viber.voip

Viber Messenger

com.whatsapp

WhatsApp Messenger

org.telegram.messenger

Telegram

ru.auto.ara

Авто.ру: купить и продать авто

ru.ok.android

OK

ru.rutaxi.vezet

Везёт – заказ такси онлайн

ru.yandex.taxi

Yandex.Taxi Ride-Hailing Service

cb.ibank

УБРиР

com.bifit.mobile.otpbank

ОТПбизнес

com.bifit.mobile.ubrr

УБРиР Pro

com.bifit.mobile.zenit

ЗЕНИТ Бизнес

com.bssys.mbcphone.akbars

АК БАРС Мобильный для Бизнеса

com.bssys.mbcphone.mts

MTS Bank. Business Client

com.bssys.mbcphone.rsbank

РС Бизнес Онлайн

com.bssys.mbcphone.ubrir

УБРиР Light

com.bssys.mbcphone.vostochny

Восточный Корпоративный

com.citibank.mobile.ru

Citibank RU

com.isimplelab.ibank.kazan

Банк Казани

com.isimplelab.isimpleceo.kazan

БК Бизнес

com.isimplelab.isimpleceo.minb

МИнБанк Бизнес

cz.bsc.rc

Ренессанс Кредит

ru.akbars.mobile

Ак Барс Онлайн 3.0

ru.avangard.legal

Авангард Бизнес

ru.bankuralsib.mb.android

Мобильный банк УРАЛСИБ

ru.beeline.card

Карта Билайн

ru.bspb

BSPB Mobile

ru.ftc.faktura.expressbank

Восточный мобайл

ru.gazprombank.android.mobilebank.app

Телекард 2.0

ru.kykyryza

Кукуруза

ru.mdm.app

Бинбанк Бизнес

ru.minbank.android

МИнБ

ru.mkb.business

МКБ Бизнес

ru.mkb.mobile

МКБ Мобайл

ru.otpbank

ОТПкредит

ru.psbank.msb.dev.psb_appstore

PSB Мой Бизнес

ru.raiffeisen.android.rbo

Райффайзен Бизнес

ru.raiffeisennews

Raiffeisen Online Russia

ru.rocketbank.r2d2

Рокетбанк

ru.rshb.dbo

Мобильный банк, Россельхозбанк

ru.rshb.dboul

Россельхозбанк Бизнес-Онлайн

ru.skbbank.ib

СКБ Онлайн

ru.skbbank.ibank

СКБ-банк

ru.stepup.MDMmobileBank

Бинбанк online 2.0

ru.ucb.android

Mobile.UniCredit

ru.vtb24.biz.client.android

ВТБ Бизнес Онлайн

ru.zenit.android

ЗЕНИТ Онлайн 2.0

de.ingdiba.bankingapp

ING-DiBa Banking to go

btc.org.freewallet.app

Bitcoin Wallet by Freewallet

com.alibaba.aliexpresshd

AliExpress - Smarter Shopping, Better Living

com.bitcoin.mwallet

Bitcoin Wallet

com.bitpay.wallet

BitPay – Secure Bitcoin Wallet

com.blocktrail.mywallet

BTC.com - Bitcoin Wallet

com.booking

Booking.com Travel Deals

com.electroneum.mobile

Electroneum

com.gettaxi.android

Gett

com.google.android.play.games

Google Play Games

com.samsung.android.spay

Samsung Pay

io.totalcoin.wallet

Bitcoin Wallet Totalcoin - Buy and Sell Bitcoin

ru.aviasales

Aviasales — авиабилеты дешево

ru.tutu.tutu_emp

Tutu.ru - flights, Russian railway and bus tickets

ru.yandex.money

Yandex.Money—wallet, cards, transfers, and fines

com.google.android.apps.walletnfcrel

Google Pay

总结

Anubis自爆发以来,其主要活动区域在欧美等地,虽然目前国内暂时没有发现此类银行木马,但其代码字符串混淆中,含有中文混淆方案,所以依然值得我们警惕。Anubis主要以渗透进入谷歌商店为主要传播平台,木马本身以仿冒金融机构、主流应用程序、浏览器插件为主要伪装手段。Anubis是结合了钓鱼、远控、勒索等功能的银行木马,其功能强大到甚至可以作为一款间谍软件的存在。虽然谷歌商店一直在清理相关恶意木马,但仍然有残留的软件在活跃,此次西班牙发现Anubis通过仿冒邮政运营商Correos进行传播,也说明了Anubis一直都在并没有消失,而且其数量也并没有减少,所以我们依然要对Anubis木马提高警惕,我们也会时刻关注Anubis最新变种的出现。

IOC

MD5

3D3EC2C2F81FE4EE582DCA2E69752EE1

04D94228021B73E44261ADCCAD4173F3

D2C8F0D197A14EEFBDB9643DDB898477

e5141d3f2a3bd6ecf64089401b015f0c

1e8870eb6f141df9b8d9f4dd295188be

d045e6d5c9b493dbe35aa4cb94652072

e6ab7d099bd4f01eca83075c55eb94e1

9c7187266b2c881570cdf69af714252b

0943a47985a0b33018877676cfef6c47

6bb24ad97a777a6ced82199fa3d2e656

3590baefdcf54c69e0a363b8adaf74b9

7b7f0041263f4a6bf3d648e19e8f5201

02dd7a6fb1fc0587bdd85cc267c733a4

390674bdb17d77c9b32bd7780a176f4c

4fbeaa50b11bf58418efc8ee9eb1e2aa

93f3c95243b347f446a54ce219307bec

0ff2626fe3a449ba0ee97e68d87c9249

7ebe35cbf1eff3702f06e54a432e6f39

a519c9d681a76702cd5827a428e2fbdc

5425eb81ac515a2ee169cf748b00badb

6d15674a905941be2675ec1b4c658d94

35967f792d7f0e0fad821a34e720731e

0135026d9f4fb41466e44abcb3e03752

dc4db1997889d2aeea18e60ee6d0f9e4

17091e2d6af45fc65c46c4a5d9a54de2

53035f67f5f07bf39856f02589727b30

bcb2f691e6291e80f97dcdbece8bef4f

fb6ee9be6feaf5784e9f6ab3f8751b07

6c8e24bb040abe91f99f0624eba68615

e29f8dbba94d6402d03d06c8308dcd03

ac0e66262d431a170f2ab9cef2a96dd1

ba5daf527a6efcc8223812961267960c

df98cd6a1200a8f51791b2f06aabad88

68c72bdd2c3289613a0b649c5f67c066

028336c0f5360d9c635ff0ecc6a6b528

659aebc9b8e9a6f447ef6343893643c6

91b7f1fa55cf08adee79116d76bf4dc4

01bc9a13dd0b091b2ddce9ee2e682c0c

fd5010347cd2157604caa990f1454800

ae0bd650536ac6dcc1e98978293e5926

aa8202f424ad998c36c4b91d7db2a5ec

C778267F160B97CBB4A970F837C61FF9

dfeae0b92e2addac132ce0a941bc9651

c1419376bfbd84b94b1547003706e89d

a8b8eb22302139a0a76b8ff16bb589c6

C&C

https://twitter.com/wadaishere5

https://twitter.com/wadaishere11

https://twitter.com/scotyhall

https://twitter.com/ruyas_s

https://twitter.com/qweqweqwe

https://twitter.com/PelinSN10495193

https://twitter.com/mrzabibus

https://twitter.com/force19994

https://twitter.com/Donald19532

https://twitter.com/Alexey31405753

https://t.me/appqltkjsaa

https://nasistemeafk.sc.ug

https://188dyz.com/sett

http://wadascx1wesa.club/admin_panel

http://wadaishere.tk/admin_panel

http://translationutility.tk

http://services32.website

http://schvhost.us

http://sasaz.ru

http://mining.ltd.ua

http://colbrte.top

http://batikantognas.com.tr

http://aktivierung-342675-deustchland-services.ru

http://45.76.42.67

http://185.254.121.24

http://185.235.128.44

http://185.139.70.135

http://181.174.166.106

87600.ooo

12313.ooo

参考信息

https://info.phishlabs.com/blog/new-variant-bankbot-banking-trojan-aubis

https://www.threatfabric.com/blogs/anubis_2_malware_and_afterlife.html

声明:本文来自奇安信威胁情报中心,版权归作者所有。文章内容仅代表作者独立观点,不代表安全内参立场,转载目的在于传递更多信息。如有侵权,请联系 anquanneican@163.com。