Analysis by: Ecular Xu
 PLATFORM:

Android

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan Spy

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This malware can be found in some malicious apps that used to be available on Google Play. The app targeted Arabic-speaking users in the Middle East. It is capable of cyberespionage techniques such as recording data, stealing information, sending information to C&C servers, and a self-destruct mechanism to cover its tracks.

  TECHNICAL DETAILS

File Size: 1596477 bytes
Memory Resident: Yes

NOTES:

This malware purports itself as a normal communication app in order to hide its infostealing routines. It can steal (SMS), photos, videos, contacts, email accounts, calendar events, and browser histories (i.e., Chrome and Samsung Internet Browser).

It has the ability to take screenshots and record audio, including calls. It can monitor the victim through apps installed on the device, such as Skype, WhatsApp, Facebook, and Twitter, among others.

Upon collecting the stolen information, the information is then encrypted and sent to the C&C server.

This malware can also self-destruct to cover its tracks. It can run commands and delete files on the device, as well as install and uninstall Android Application Packages (APKs).

  SOLUTION

Minimum Scan Engine: 9.850

NOTES:
Scan your device with your Trend Micro product to delete APPs detected as ANDROIDOS_ANUBISSPY. If the detected APPs have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required.


Did this description help? Tell us how we did.