New Anubis Campaign Targets Mobile Banking Applications Worldwide

A new Anubis campaign, targeting banking applications on Android mobile devices, has been identified by researchers at Trend Micro. The banking applications targeted are based all over the world - from Australia to India to Turkey to the USA and more. Over 17,000 samples have been seen to be associated with this campaign. This malware includes functionality to conduct espionage as well as gather banking credentials, as it has capability to record device audio, send and receive text messages, open URLs, and more.

Recommendations

• Blacklist network infrastructure associated with this campaign
• Enable multifactor authentication on mobile devices whenever possible
• Regularly update mobile devices and applications
• Consider enabling the Cyber Chatter rule in order to monitor this threat

Details

A research team at Trend Micro has identified over 17,000 samples related to a new Anubis campaign. Anubis is a family of Android malware. Although Anubis began as a cyberespionage tool, it has also been seen used as a banking trojan. In this most recent campaign, it is being utilized for information theft. This malware includes functionality for recording audio on an infected mobile device, sending, receiving, and deleting SMS text messages, locking the screen, opening specific URLs, configuring administrator settings on the device, and more.

In particular, this Anubis campaign was seen to be targeting a number of different banking applications. It is able to hijack the Android activity of a targeted banking app, in order to monitor activity within the app. In total, 188 banking applications were seen to be targeted - with locations in Australia, Turkey, Germany, France, Italy, Spain, India, and the USA. Additionally, this campaign used social media accounts, specifically Twitter, in order to send command and control instructions.

For further details, please see Trend Micro's research blog here.

IOCs

Publicly available hashes

9046270d735579bcedb6bb7c0a2ad21f9b5ef9432e46e733b36de964aecd3abc
6079af3bab8bb0ba445cd0dd896d8c8d7845da3757755b4ef3af584d227e0490
1acca6953081cfc12d5cbeda1990b93b3298b1adc3c6ffad624e454f5854736f
f767baadda60c618d7e14461831e7371a54cdf152b1fd5eb52a8aa4bb7300227

Domains

hxxp://demo[.]website[.]com/
hxxp://ktosdelaetskrintotpidor[.]com
hxxp://marksteylor[.]us/
hxxp://sositehuypidarasi[.]com
hxxps://blackleaf[.]top
hxxps://firstdoxed[.]space
hxxps://lskbfidsbvkjsfgakfjsdffsdfupdate[.]net
hxxps://lskbfidsbvkjsfgakfjsdffsdfupdate[.]net/o1o/a16[.]php
hxxps://ndudetto[.]top
hxxps://playclints1[.]space
hxxps://sositehuypidarasi[.]com
hxxps://t[.]me/newpaparoni
hxxps://t[.]me/thethe123
hxxps://t[.]me/unite11