TF-MAL-apk.anubisspy
📛 Threat Title
Malware family: AnubisSpy
Description
ThreatFox malware family `apk.anubisspy`. Printable name: AnubisSpy.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.anubisspy
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.anubisspy
IOC database
- Type
- domain
- Value
apk.anubisspy- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.anubisspy
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.anubisspy
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:assets.recordedfuture.com
Mobile malware threats continued to grow in H1 2025, with Android banking trojans adopting virtualization-based overlays and near-field communication NFC relay attacks to bypass user defenses and enable real-world financial fraud. These innovations reflect a growing trend in financial fraud toward mobile-first exploitation targeting both app and payment ecosystems. Ransomware groups, meanwhile ...
-
web:documents.trendmicro.com
We named these malicious apps AnubisSpy (ANDROIDOS_ANUBISSPY) as all the malware's payload is a package called watchdog. We construe AnubisSpy to be linked to the cyberespionage campaign Sphinx (APT-C-15) based on shared file structures and command-and-control (C&C) server as well as targets.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the AnubisSpy malware family including references, samples and yara signatures.
-
web:sensorstechforum.com
AnubisSpy Android Malware Capabilities According to the research, the malware can steal SMS messages, photos, videos, contacts, email accounts, calendar events, and browser histories. It can also take screenshots and record audio, calls inclusive. Not only this, but it can also spy on the victim via apps installed on the device.
-
web:threatintelligence.garden.handsomezebra.com
AnubisSpy Description (Trend Micro) AnubisSpy can steal messages (SMS), photos, videos, contacts, email accounts, calendar events, and browser histories (i.e., Chrome and Samsung Internet Browser).
-
web:ti.dbappsecurity.com.cn
Shared C&C server, 86[.]105[.]18[.]107 Shared technique of decrypting JSON files, and similarity between the file structures of AnubisSpy and Sphinx's malware Similar targets (highly concentrated in Middle Eastern countries) Figure 2: Comparison of file structure in Sphinx's AnubisSpy (right)
-
web:www.bitdefender.com
According to the advisory (FLASH-20260219-001), cybercriminals are increasingly deploying sophisticated malware — particularly variants of the Ploutus family — to force Automated Teller Machines (ATMs) to dispense cash without any legitimate transaction or bank authorization.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.fbi.gov
Threat actors exploit physical and software vulnerabilities in ATMs and deploy malware to dispense cash without a legitimate transaction. The FBI has observed an increase in ATM jackpotting ...
-
web:www.scworld.com
Trend Micro reports that AnubisSpy shares the same file structures, command-and-control server, JSON file decryption technique, and targets as the aforementioned old Sphinx campaign, which typically used watering hole attacks to infect victims with the njRAT trojan.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Reputation of linked indicators
DomScan scores the domains, AbuseIPDB + GreyNoise score the IPs. Verdicts are per-indicator — this is a roll-up, so no lookup is triggered by opening this page.
| Indicator | Type | Verdict | Score |
|---|---|---|---|
apk.anubisspy |
domain | high | 44 |