Overview

overview

10

Static

static

10

ready.apk

android-11-x64

8

ready.apk

android-9-x86

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ready.apk

  • Size

    692KB

  • Sample

    231008-3bm7raah56

  • MD5

    ca1bf0b30f666f09b4b2d7cd55edf408

  • SHA1

    9d6ff22516240d0cd6561b0d0df8d1c902d4200c

  • SHA256

    062c76f12ba030ce8237a57ee794557ae980e4b21769c77125811fc06a49becf

  • SHA512

    6b83ee447711b6304ccf19eef68566c7a11fc46c3c38973020576a1b97990bdf0aae60cb4cf00600997507392475bdfba7986316cb41e7f895e0f4a04aafc2f6

  • SSDEEP

    12288:g+EhI2/TABV+Ti1n+aLLN0QhDeFusT3cgtN0Fdo6Rq21IgaWtWDaX:g+fMsVBVPuSCFHT3SFdoGNdCaX

Score
10/10
spynoteandroidbankerevasionstealthtrojan

Malware Config

Extracted

Family

spynote

C2

mode-apollo.gl.at.ply.gg:59320

Targets

    • Target

      ready.apk

    • Size

      692KB

    • MD5

      ca1bf0b30f666f09b4b2d7cd55edf408

    • SHA1

      9d6ff22516240d0cd6561b0d0df8d1c902d4200c

    • SHA256

      062c76f12ba030ce8237a57ee794557ae980e4b21769c77125811fc06a49becf

    • SHA512

      6b83ee447711b6304ccf19eef68566c7a11fc46c3c38973020576a1b97990bdf0aae60cb4cf00600997507392475bdfba7986316cb41e7f895e0f4a04aafc2f6

    • SSDEEP

      12288:g+EhI2/TABV+Ti1n+aLLN0QhDeFusT3cgtN0Fdo6Rq21IgaWtWDaX:g+fMsVBVPuSCFHT3SFdoGNdCaX

    Score
    8/10
    bankerevasionstealthtrojan

    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

      banker

    • Removes its main activity from the application launcher

      stealthtrojan

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries the unique device ID (IMEI, MEID, IMSI).

    • Requests enabling of the accessibility settings.

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks