Analysis
-
max time kernel
2417560s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 06:43
General
-
Target
8c75835a952a796619ad298cd37a01a7e0167438acc61def69d5730a4642506f.apk
-
Size
725KB
-
MD5
99f09523008ecb09a92ac0304b7f51d4
-
SHA1
5b3cc3d29146d63dcc38fa0a10918006864230a6
-
SHA256
8c75835a952a796619ad298cd37a01a7e0167438acc61def69d5730a4642506f
-
SHA512
5015a44a6f23f4aefc288f53f80dcc2619ea05d5b7d81be7f7a9ec5460b60b1174aa9d813862193f1bb6370573618e508a623071aab54e8aed9b57d99f91bbb3
-
SSDEEP
12288:yh9rIjntUmcjqimMKHkQobS/5Z0lvMpFJanM43VvfidybhiYc:M9rI5EqimpEE5Z0WPkMMfbhHc
Malware Config
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote payload 1 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.Alino1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.Alino/app_ded/qpDVyarfP60Veck5DyHYtOdOQt2epofp.dexFilesize
571KB
MD5a7c9e95bb27a8fed225f140d89bf66dd
SHA11ed983441c1fb80519581d351d168b3eb5418729
SHA256e209326bb4d51c666b7d7957b906cf3c6983a99a1ceb0deb6c30727962a8bfa0
SHA5121992d345d4384bf30d764cb108f119955503d53ae79b5aa1e2c23670c9a50389fab0d33685c945b5fcd1cc5d9b556de99c0f9c068b4705c32985f5c1df4d5e03