Extracted

• • Target

    3FD8EA36058A9B8CEF94D7B6B14E189A21A6FA1CC326B57575BB766A4611CD95.apk

  • Size

    5.3MB

  • MD5

    493fc7221eebc29926f3b0862cad16e4

  • SHA1

    4489eb924fbd2ed3069864916bdfd1e4a44d0141

  • SHA256

    3fd8ea36058a9b8cef94d7b6b14e189a21a6fa1cc326b57575bb766a4611cd95

  • SHA512

    5f313e08fc45dd3714e3183f45704a92349f594f89d62853776ebbeab66197397bc614c8b1404c961674bee8e94731c462c2a2a7e39be934ec207d5b5e4aa1fe

  • SSDEEP

    98304:iuF2ASmzfzBpTg0tghrkG/7SCdNeFNITzVd4grhm69vVsyfGqYVPuYkKJtybuyV+:iZAdznLfG/zQFmnVd4g9D9v1SuYiuyzE

  Score

  10^/10

  spynotebankerevasioninfostealerratstealthtrojan

  • Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote

  • Makes use of the framework's Accessibility service.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

    banker

  • Removes its main activity from the application launcher

    stealthtrojan

  • Acquires the wake lock.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Removes a system notification.

    evasion
  behavioral1behavioral2