spynote | 3fd8ea36058a9b8cef94d7b6b14e189a21a6fa1cc326b57575bb766a4611cd95

Analysis

max time kernel
1954629s
max time network
161s
platform
android_x64
resource
android-x64-arm64-20230831-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system
submitted
08-09-2023 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3FD8EA36058A9B8CEF94D7B6B14E189A21A6FA1CC326B57575BB766A4611CD95.apk
Size

5.3MB
MD5

493fc7221eebc29926f3b0862cad16e4
SHA1

4489eb924fbd2ed3069864916bdfd1e4a44d0141
SHA256

3fd8ea36058a9b8cef94d7b6b14e189a21a6fa1cc326b57575bb766a4611cd95
SHA512

5f313e08fc45dd3714e3183f45704a92349f594f89d62853776ebbeab66197397bc614c8b1404c961674bee8e94731c462c2a2a7e39be934ec207d5b5e4aa1fe
SSDEEP

98304:iuF2ASmzfzBpTg0tghrkG/7SCdNeFNITzVd4grhm69vVsyfGqYVPuYkKJtybuyV+:iZAdznLfG/zQFmnVd4g9D9v1SuYiuyzE

Score

10^/10

spynote banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

spynote

37.247.101.167:4441

Signatures

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.ojgeqprqw.velmmoxtz

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ojgeqprqw.velmmoxtz
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.ojgeqprqw.velmmoxtz
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ojgeqprqw.velmmoxtz

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.ojgeqprqw.velmmoxtz

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.ojgeqprqw.velmmoxtz
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

com.ojgeqprqw.velmmoxtz

pid process

4658 com.ojgeqprqw.velmmoxtz
Acquires the wake lock. 1 IoCs

Processes:

com.ojgeqprqw.velmmoxtz

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.ojgeqprqw.velmmoxtz

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.ojgeqprqw.velmmoxtz

pid	process
4658	com.ojgeqprqw.velmmoxtz

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ojgeqprqw.velmmoxtz

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.ojgeqprqw.velmmoxtz

ioc	pid	process
/data/user/0/com.ojgeqprqw.velmmoxtz/app_app_dex/djqfejr.sme	4658	com.ojgeqprqw.velmmoxtz
/data/user/0/com.ojgeqprqw.velmmoxtz/app_app_dex/djqfejr.sme	4658	com.ojgeqprqw.velmmoxtz
/data/user/0/com.ojgeqprqw.velmmoxtz/app_app_dex/jmrffmf.sme	4658	com.ojgeqprqw.velmmoxtz
/data/user/0/com.ojgeqprqw.velmmoxtz/app_app_dex/jmrffmf.sme	4658	com.ojgeqprqw.velmmoxtz

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.ojgeqprqw.velmmoxtz

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.ojgeqprqw.velmmoxtz
Removes a system notification. 1 IoCs
evasion

Processes:

com.ojgeqprqw.velmmoxtz

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.ojgeqprqw.velmmoxtz

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.ojgeqprqw.velmmoxtz

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.ojgeqprqw.velmmoxtz

com.ojgeqprqw.velmmoxtz
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4658

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ojgeqprqw.velmmoxtz/app_app_dex/djqfejr.sme

Filesize
311KB

MD5
5bd34129fe8ba5149103046e95e307fa

SHA1
cb35ae536db60e9ea5d8e19cc428fd80e7ec090e

SHA256
60362c2b204a07ae0730a386d4e9426b62220452a12f45c17d4fe6ef17bae6ee

SHA512
45bc71c2bdacc2693a44df4aeeddfb31190cde6ad20ab748e9b3b48021b19d986fe4f5baccc8b64f0e3d6613efceb1b9d7d5d417a497c0eee3d8bf6bce601e16

Download Submit
/data/user/0/com.ojgeqprqw.velmmoxtz/app_app_dex/djqfejr.sme

Filesize
311KB

MD5
5bd34129fe8ba5149103046e95e307fa

SHA1
cb35ae536db60e9ea5d8e19cc428fd80e7ec090e

SHA256
60362c2b204a07ae0730a386d4e9426b62220452a12f45c17d4fe6ef17bae6ee

SHA512
45bc71c2bdacc2693a44df4aeeddfb31190cde6ad20ab748e9b3b48021b19d986fe4f5baccc8b64f0e3d6613efceb1b9d7d5d417a497c0eee3d8bf6bce601e16

Download Submit
/data/user/0/com.ojgeqprqw.velmmoxtz/app_app_dex/djqfejr.sme

Filesize
311KB

MD5
5bd34129fe8ba5149103046e95e307fa

SHA1
cb35ae536db60e9ea5d8e19cc428fd80e7ec090e

SHA256
60362c2b204a07ae0730a386d4e9426b62220452a12f45c17d4fe6ef17bae6ee

SHA512
45bc71c2bdacc2693a44df4aeeddfb31190cde6ad20ab748e9b3b48021b19d986fe4f5baccc8b64f0e3d6613efceb1b9d7d5d417a497c0eee3d8bf6bce601e16

Download Submit
/data/user/0/com.ojgeqprqw.velmmoxtz/app_app_dex/jmrffmf.sme

Filesize
3.2MB

MD5
424910b21bd214f5a36ec3e4aaeca622

SHA1
23680b19dd33313efca12da9fa8ba24465620d15

SHA256
7a030a5df39220bec28b9a260734d9e6d5ed75116e9b28d64914600591386190

SHA512
b2d8966a9661ddc19f09208253332d339317e24c123001445d784ae898b3fe3c8336041ec4e6974d6871f75a8325fc7357e85237772b28451d6d5c50a53b676b

Download Submit
/data/user/0/com.ojgeqprqw.velmmoxtz/app_app_dex/jmrffmf.sme

Filesize
3.2MB

MD5
424910b21bd214f5a36ec3e4aaeca622

SHA1
23680b19dd33313efca12da9fa8ba24465620d15

SHA256
7a030a5df39220bec28b9a260734d9e6d5ed75116e9b28d64914600591386190

SHA512
b2d8966a9661ddc19f09208253332d339317e24c123001445d784ae898b3fe3c8336041ec4e6974d6871f75a8325fc7357e85237772b28451d6d5c50a53b676b

Download Submit
/data/user/0/com.ojgeqprqw.velmmoxtz/app_app_dex/jmrffmf.sme

Filesize
3.2MB

MD5
424910b21bd214f5a36ec3e4aaeca622

SHA1
23680b19dd33313efca12da9fa8ba24465620d15

SHA256
7a030a5df39220bec28b9a260734d9e6d5ed75116e9b28d64914600591386190

SHA512
b2d8966a9661ddc19f09208253332d339317e24c123001445d784ae898b3fe3c8336041ec4e6974d6871f75a8325fc7357e85237772b28451d6d5c50a53b676b

Download Submit
/data/user/0/com.ojgeqprqw.velmmoxtz/files/lltfsu.hlp

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-08.txt

Filesize
21B

MD5
ca913b9f97d71df97047f91c751d3e87

SHA1
f99af88dc53731c5252cfaa5916dab83d0374eee

SHA256
38f65273cbdc7465686ea53bc9b4903dcb37f05373f42159b2823eb16706a141

SHA512
830a2fb4f810a0c4b619e29e23c957e73e1f98a99589e41e1009bea8d7a6c3dd6f70dda68af0bc8f55135c1c1a6c5df6569fb5efed6c4c5cdf3b12459f263fe0

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-08.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-08.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-08.txt

Filesize
276B

MD5
d388f077b178b6b9f557a16f636c10c9

SHA1
4320199c43bc650ace8c0376f82e0f37572ba0ab

SHA256
2d3404de7126caffc3872b0c71af481d4949f7b5477a394bd661a4babd2696e9

SHA512
3d4c34812abca71d0afd21d7d328ddfc1882d31becfee479c1a3e8fcdce241134b706353214366f7c9c02b8803073c3b494a99784bf5fae3fc029fe6c5d8295f

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-08.txt

Filesize
57B

MD5
3af69119804d1d999d56d230338ffd36

SHA1
69350826205583c8acc385ee0a6e3fc2673ee2ca

SHA256
10994862cb263ab6b1e4428cc24cc9c585458fc67544fe0f5dfea81a5a7a115c

SHA512
4a41b19d28f637b397d9dff225621694c44c750a9bd65f3e6ad5d3b9acf0d118910ddf53d4618213f9e14c61e0fb154f33f2747dd3b8d50459990767f42fc8cb

Download Submit