Analysis
-
max time kernel
2417503s -
max time network
146s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system -
submitted
20-12-2023 06:43
Static task
static1
Behavioral task
behavioral1
Sample
8c75835a952a796619ad298cd37a01a7e0167438acc61def69d5730a4642506f.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
8c75835a952a796619ad298cd37a01a7e0167438acc61def69d5730a4642506f.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
8c75835a952a796619ad298cd37a01a7e0167438acc61def69d5730a4642506f.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
8c75835a952a796619ad298cd37a01a7e0167438acc61def69d5730a4642506f.apk
-
Size
725KB
-
MD5
99f09523008ecb09a92ac0304b7f51d4
-
SHA1
5b3cc3d29146d63dcc38fa0a10918006864230a6
-
SHA256
8c75835a952a796619ad298cd37a01a7e0167438acc61def69d5730a4642506f
-
SHA512
5015a44a6f23f4aefc288f53f80dcc2619ea05d5b7d81be7f7a9ec5460b60b1174aa9d813862193f1bb6370573618e508a623071aab54e8aed9b57d99f91bbb3
-
SSDEEP
12288:yh9rIjntUmcjqimMKHkQobS/5Z0lvMpFJanM43VvfidybhiYc:M9rI5EqimpEE5Z0WPkMMfbhHc
Malware Config
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote payload 1 IoCs
Processes:
resource yara_rule /data/data/com.Alino/app_ded/i4emojxSJqIWRIrHE6nk1e8I7ADis3qx.dex family_spynote -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
Processes:
com.Alinodescription ioc process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.Alino -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.Alinoioc pid process /data/user/0/com.Alino/app_ded/i4emojxSJqIWRIrHE6nk1e8I7ADis3qx.dex 4991 com.Alino /data/user/0/com.Alino/app_ded/i4emojxSJqIWRIrHE6nk1e8I7ADis3qx.dex 4991 com.Alino -
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes:
com.Alinodescription ioc process Framework API call javax.crypto.Cipher.doFinal com.Alino
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.Alino/app_ded/i4emojxSJqIWRIrHE6nk1e8I7ADis3qx.dexFilesize
571KB
MD5a7c9e95bb27a8fed225f140d89bf66dd
SHA11ed983441c1fb80519581d351d168b3eb5418729
SHA256e209326bb4d51c666b7d7957b906cf3c6983a99a1ceb0deb6c30727962a8bfa0
SHA5121992d345d4384bf30d764cb108f119955503d53ae79b5aa1e2c23670c9a50389fab0d33685c945b5fcd1cc5d9b556de99c0f9c068b4705c32985f5c1df4d5e03