Overview

overview

10

Static

static

10

bffc0b6757...57.apk

android-9-x86

8

bffc0b6757...57.apk

android-10-x64

8

bffc0b6757...57.apk

android-11-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bffc0b6757f47fe056f45cc73b7bcd57.apk

  • Size

    8.5MB

  • Sample

    231011-lq894aee8y

  • MD5

    bffc0b6757f47fe056f45cc73b7bcd57

  • SHA1

    5bb41f418cbb8e994fd410f4040545a428ae0c1d

  • SHA256

    d271655cc1451a97c0a64ba45a976dd6138cc1d985a87fbd123bfebf29fbd599

  • SHA512

    c14e1dea37fcb15ebdd0b6d4168afbb2a89981936b10f3baafdab6c2db45d82a07ca00f34d2ebe7b686a121163d95a29daf0348381c7009920269faf2e4287ed

  • SSDEEP

    98304:RmwCr6gQKMutHoU15N63+tDTcnmz3zByTr0toZH4:4V6gQKM8IU176WT/zkUR

Score
10/10
spynoteandroidbankerevasionstealthtrojan

Malware Config

Extracted

Family

spynote

C2

37.120.141.134:7775

Targets

    • Target

      bffc0b6757f47fe056f45cc73b7bcd57.apk

    • Size

      8.5MB

    • MD5

      bffc0b6757f47fe056f45cc73b7bcd57

    • SHA1

      5bb41f418cbb8e994fd410f4040545a428ae0c1d

    • SHA256

      d271655cc1451a97c0a64ba45a976dd6138cc1d985a87fbd123bfebf29fbd599

    • SHA512

      c14e1dea37fcb15ebdd0b6d4168afbb2a89981936b10f3baafdab6c2db45d82a07ca00f34d2ebe7b686a121163d95a29daf0348381c7009920269faf2e4287ed

    • SSDEEP

      98304:RmwCr6gQKMutHoU15N63+tDTcnmz3zByTr0toZH4:4V6gQKM8IU176WT/zkUR

    Score
    8/10
    bankerevasionstealthtrojan

    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

      banker

    • Removes its main activity from the application launcher

      stealthtrojan

    • Acquires the wake lock.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks