aol.pm

Anubis

Software · ATTACK:mobile:S0422

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:S0422",
  "title": "Anubis",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0422",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--a3c59d82-2c7c-44e5-a869-68e0a3e5935e",
  "external_id": "S0422",
  "domain": "mobile",
  "created": "2020-04-08T15:41:19.114Z",
  "modified": "2026-09-02T18:52:07.416Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Cofense Anubis",
      "url": "https://web.archive.org/web/20231222134431/https://cofense.com/blog/infostealer-keylogger-ransomware-one-anubis-targets-250-android-applications/"
    }
  ]
}

Explicit source assertions (22)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1453

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--183edec4-71b8-4122-a81b-102256e5db13

Cyble_Anubis_May2021

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fdad4b5-18a1-4fbf-81ce-861feaf2bbdd

Trend Micro Anubis · Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2621a020-8d4f-4ca4-b874-0be336a8cafd

Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35453bbb-c9b3-4421-8452-95efdd290d21

Zimperium z9

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50ad2a8c-ed45-4376-be31-8bafa26ba794

Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b87bb01-9587-42bd-aa6b-30158ca8f55f

Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1633.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67db22d4-6f89-40c6-b31b-737c1e3dec3f

Trend Micro Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6935752c-e400-4dfa-863f-1d44a8f6dd50

Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c35f99c-153d-4023-a29a-821488ce5418

Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1417.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6faacfdd-d17d-4c6e-a33e-5fdea2cc3998

Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1629.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7bf2e05e-496f-49d1-8a37-48cc3ff8d6cc

Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1471

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ee49e53-e75d-4e65-a71f-79919ebb08f4

Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1430

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--806a9338-be20-4eef-aa54-067633ac0e58

Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82e93a9e-6968-497f-8043-a08d0f35bd32

Trend Micro Anubis · Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f72a070-cfcb-4d75-ace6-b4427f3ba8d3

Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9814ecd5-911a-4776-9dc0-4a4ae0bf6a39

Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c200184f-3d11-452c-8362-bb66337df1f5

Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1629.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb5465c0-a577-45b1-becf-305e0bd47497

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbf17fea-141e-44b8-831c-b3cc41066420

Trend Micro Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d01b311d-8741-4b58-b127-88fecb2b0544

Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1481.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dff37d8a-b7ca-409b-b4eb-581ca3a74bb5

Trend Micro Anubis · Cofense Anubis

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7af5be1-721f-40c5-b647-659243a0a14b

Cofense Anubis

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.