spynote | 8c75835a952a796619ad298cd37a01a7e0167438acc61def69d5730a4642506f

Analysis

max time kernel
2510337s
max time network
130s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
20-12-2023 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c75835a952a796619ad298cd37a01a7e0167438acc61def69d5730a4642506f.apk
Size

725KB
MD5

99f09523008ecb09a92ac0304b7f51d4
SHA1

5b3cc3d29146d63dcc38fa0a10918006864230a6
SHA256

8c75835a952a796619ad298cd37a01a7e0167438acc61def69d5730a4642506f
SHA512

5015a44a6f23f4aefc288f53f80dcc2619ea05d5b7d81be7f7a9ec5460b60b1174aa9d813862193f1bb6370573618e508a623071aab54e8aed9b57d99f91bbb3
SSDEEP

12288:yh9rIjntUmcjqimMKHkQobS/5Z0lvMpFJanM43VvfidybhiYc:M9rI5EqimpEE5Z0WPkMMfbhHc

Score

10^/10

spynote banker infostealer rat trojan

Malware Config

Signatures

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 2 IoCs

Processes:

resource	yara_rule
/data/data/com.Alino/app_ded/MlYmKkawAhNNbYUb5fwffadW31Aqj9Cl.dex	family_spynote
/data/user/0/com.Alino/app_ded/MlYmKkawAhNNbYUb5fwffadW31Aqj9Cl.dex	family_spynote

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
banker

Processes:

com.Alino

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.Alino

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.Alino

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.Alino/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.Alino/app_ded/MlYmKkawAhNNbYUb5fwffadW31Aqj9Cl.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.Alino/app_ded/oat/x86/MlYmKkawAhNNbYUb5fwffadW31Aqj9Cl.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.Alino/app_ded/MlYmKkawAhNNbYUb5fwffadW31Aqj9Cl.dex	4229	com.Alino
/data/user/0/com.Alino/app_ded/MlYmKkawAhNNbYUb5fwffadW31Aqj9Cl.dex	4254	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.Alino/app_ded/MlYmKkawAhNNbYUb5fwffadW31Aqj9Cl.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.Alino/app_ded/oat/x86/MlYmKkawAhNNbYUb5fwffadW31Aqj9Cl.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.Alino/app_ded/MlYmKkawAhNNbYUb5fwffadW31Aqj9Cl.dex	4229	com.Alino

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.Alino

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.Alino

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.Alino

com.Alino
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4229

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.Alino/app_ded/MlYmKkawAhNNbYUb5fwffadW31Aqj9Cl.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.Alino/app_ded/oat/x86/MlYmKkawAhNNbYUb5fwffadW31Aqj9Cl.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4254

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.Alino/app_ded/MlYmKkawAhNNbYUb5fwffadW31Aqj9Cl.dex
Filesize
571KB

MD5
a7c9e95bb27a8fed225f140d89bf66dd

SHA1
1ed983441c1fb80519581d351d168b3eb5418729

SHA256
e209326bb4d51c666b7d7957b906cf3c6983a99a1ceb0deb6c30727962a8bfa0

SHA512
1992d345d4384bf30d764cb108f119955503d53ae79b5aa1e2c23670c9a50389fab0d33685c945b5fcd1cc5d9b556de99c0f9c068b4705c32985f5c1df4d5e03

Download Submit
/data/user/0/com.Alino/app_ded/MlYmKkawAhNNbYUb5fwffadW31Aqj9Cl.dex
Filesize
571KB

MD5
953872637cbd6785805912582bda5a6d

SHA1
ce4db5d68c3f63b104ad9139ff42c580f0f15ad9

SHA256
bd543c3571a7658f1890be892c80925f468d838de03321024351163d22821349

SHA512
7bbc8f4eb0c0d9e345d424baf9f8e566e8364a0f067cac32c2b4fff7fe15972194419cbd561d6f2628158442a2ef17b9b9cfba56c0f5e411b82a05d095286093

Download Submit