Overview

overview

10

Static

static

6

af30de5783...f4.apk

 

af30de5783...f4.apk

android-10-x64

10

af30de5783...f4.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    af30de5783f3e57878e5188ebc70cf3fb1457f1f17150a7614e4688df2b1d5f4

  • Size

    668KB

  • Sample

    231220-n5fx7sfehk

  • MD5

    4a5047bcc3eb02571dc503dc914598eb

  • SHA1

    d14c09ba569c5ae8288c17e9699a2da25df8248c

  • SHA256

    af30de5783f3e57878e5188ebc70cf3fb1457f1f17150a7614e4688df2b1d5f4

  • SHA512

    89701172320395ed35b61d4ce5bd98e37371c6ced665d2930c547a21804a07401e081a0a787fc024640d3f6f8253cb81a115919ab248d7e781882930d98fa768

  • SSDEEP

    12288:XdjSML/KAFi95Ndf3lvqD4kwW8g6Ey5oTjG30gbB0M2j:wMjpijNF3Kf8ghNjG3z0M2j

Score
10/10
spynoteandroidbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

spynote

C2

188.121.120.42:7771

Targets

    • Target

      af30de5783f3e57878e5188ebc70cf3fb1457f1f17150a7614e4688df2b1d5f4

    • Size

      668KB

    • MD5

      4a5047bcc3eb02571dc503dc914598eb

    • SHA1

      d14c09ba569c5ae8288c17e9699a2da25df8248c

    • SHA256

      af30de5783f3e57878e5188ebc70cf3fb1457f1f17150a7614e4688df2b1d5f4

    • SHA512

      89701172320395ed35b61d4ce5bd98e37371c6ced665d2930c547a21804a07401e081a0a787fc024640d3f6f8253cb81a115919ab248d7e781882930d98fa768

    • SSDEEP

      12288:XdjSML/KAFi95Ndf3lvqD4kwW8g6Ey5oTjG30gbB0M2j:wMjpijNF3Kf8ghNjG3z0M2j

    Score
    10/10
    spynotebankerinfostealerratstealthtrojanevasion

    • Spynote

      Spynote is a Remote Access Trojan first seen in 2017.

      bankertrojaninfostealerratspynote

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Removes its main activity from the application launcher

      stealthtrojan

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks