Overview

overview

10

Static

static

10

ready.apk

android-10-x64

8

ready.apk

android-11-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ready.apk

  • Size

    6.2MB

  • Sample

    230912-twx31seb6s

  • MD5

    f55f7f03bf6815b5d34181865e414e17

  • SHA1

    210d8e0454449de94e4eb18b675902e7a3497658

  • SHA256

    67208202460427473c38d2abb1d49a5078a39287d2b8e491bab503c83b947e04

  • SHA512

    2e4bf09754b1a2cb15ae82b802bfdeb65821e29aa994bf7bd941e9b8580c8db09902fc61e1824996d70d36d18d6828b463ab93a3f8d494cd408b05cafca633a0

  • SSDEEP

    24576:9rZ7OO54MxfbcgbUPLC8Lse/M0GPaok79XT:9r/x4DLX/MfON

Score
10/10
spynoteandroidbankerevasionstealthtrojan

Malware Config

Extracted

Family

spynote

C2

fee-harmful.gl.at.ply.gg:41934

Targets

    • Target

      ready.apk

    • Size

      6.2MB

    • MD5

      f55f7f03bf6815b5d34181865e414e17

    • SHA1

      210d8e0454449de94e4eb18b675902e7a3497658

    • SHA256

      67208202460427473c38d2abb1d49a5078a39287d2b8e491bab503c83b947e04

    • SHA512

      2e4bf09754b1a2cb15ae82b802bfdeb65821e29aa994bf7bd941e9b8580c8db09902fc61e1824996d70d36d18d6828b463ab93a3f8d494cd408b05cafca633a0

    • SSDEEP

      24576:9rZ7OO54MxfbcgbUPLC8Lse/M0GPaok79XT:9r/x4DLX/MfON

    Score
    8/10
    bankerevasionstealthtrojan

    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

      banker

    • Removes its main activity from the application launcher

      stealthtrojan

    • Acquires the wake lock.

    • Tries to add a device administrator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks