ANDROIDOS_ANUBISSPY

This malware can be found in some malicious apps that used to be available on Google Play. The app targeted Arabic-speaking users in the Middle East. It is capable of cyberespionage techniques such as recording data, stealing information, sending information to C&C servers, and a self-destruct mechanism to cover its tracks.

NOTES:

This malware purports itself as a normal communication app in order to hide its infostealing routines. It can steal (SMS), photos, videos, contacts, email accounts, calendar events, and browser histories (i.e., Chrome and Samsung Internet Browser).

It has the ability to take screenshots and record audio, including calls. It can monitor the victim through apps installed on the device, such as Skype, WhatsApp, Facebook, and Twitter, among others.

Upon collecting the stolen information, the information is then encrypted and sent to the C&C server.

This malware can also self-destruct to cover its tracks. It can run commands and delete files on the device, as well as install and uninstall Android Application Packages (APKs).