Executive Summary

Impact

Technical Impact

• Encrypt the victim’s data, and delete files
• Establish VNC session between the victim and the attacker
• Forward Calls and SMS to the attacker’s server

Business Impact

• Expose the privacy of the victim
• Steal banking credentials

Mitigation

• Keep pace with the latest security updates
• Use latest version operating systems
• Install application only from authorized app stores

Technical Analysis

Execution

• Drive-by download, where the malicious apk is downloaded directly into the victim’s device through malicious websites.
• Through Google Play store where it appears as legitimate applications, which after installation, installs the malicious payload at the second stage.

Capabilities

• Exfiltrating data after encryption
• Receive C2 commands
• Keylogging
• Encrypting data with the extension .AnubisCrypt, activating a ransomware
• Start a VNC session, in which the attacker can only see the screen of the victim and not control it.
• Intercept calls and SMSs and forward them to the attacker’s server.
• Establish overlay attack if any banking application exists on the victim’s device, to steal credentials. The overlay attack is carried out by loading Webview above the legitimate application, where the malicious applications are launched instead of the genuine application.
• Prevent the victim from uninstalling the malicious applications by listening to accessibility events.

Tactics, Techniques and Procedures

List of Commands Received from the C2 Server

Indicators of Compromise