Analysis
-
max time kernel
3339554s -
max time network
156s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system -
submitted
01-01-2024 22:00
Static task
static1
Behavioral task
behavioral1
Sample
397d80e7f2c85b8921150d568c32deb43a157944cb993225e9907452179893b3.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
397d80e7f2c85b8921150d568c32deb43a157944cb993225e9907452179893b3.apk
Resource
android-x64-20231215-en
General
-
Target
397d80e7f2c85b8921150d568c32deb43a157944cb993225e9907452179893b3.apk
-
Size
3.0MB
-
MD5
bc9a4b7c49f7a2843bb7c63eadf0721d
-
SHA1
837f19d9f53e46a33f09d4ad26ba57a024818d8b
-
SHA256
397d80e7f2c85b8921150d568c32deb43a157944cb993225e9907452179893b3
-
SHA512
dd38c1efd759354acdbe60b7fb3cfbf57ff1af7bfb7855f718741b4cce124d946c7bf05977112e05bbb9c29787fb00a0713fb7132b2d46c94c995ac838033446
-
SSDEEP
49152:nDSSKOp7JsQ+52g8VxxR1c7W/kQS3jphfaIEwTxvJaw2SR9GBRUES787cGBJmlE7:OIJab6hP/+phCzijpGBRUESYwGBUlEWc
Malware Config
Extracted
spynote
165.227.31.192:22813
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.khelo.winindiadescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.khelo.winindia Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.khelo.winindia Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.khelo.winindia -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
Processes:
com.khelo.winindiadescription ioc process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.khelo.winindia -
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.khelo.winindiaioc pid process /data/user/0/com.khelo.winindia/app_ded/SPTewyWDHdZ0PhZG6BXiMMdOwdVrmPcf.dex 5060 com.khelo.winindia /data/user/0/com.khelo.winindia/app_ded/SPTewyWDHdZ0PhZG6BXiMMdOwdVrmPcf.dex 5060 com.khelo.winindia /data/user/0/com.khelo.winindia/app_mph_dex/apk.manager-v1.rizal.xml 5060 com.khelo.winindia /data/user/0/com.khelo.winindia/app_mph_dex/apk.manager-v1.rizal.xml 5060 com.khelo.winindia -
Acquires the wake lock 1 IoCs
Processes:
com.khelo.winindiadescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.khelo.winindia -
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes:
com.khelo.winindiadescription ioc process Framework API call javax.crypto.Cipher.doFinal com.khelo.winindia
Processes
-
com.khelo.winindia1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.khelo.winindia/app_ded/SPTewyWDHdZ0PhZG6BXiMMdOwdVrmPcf.dexFilesize
94KB
MD5c2665ded30fa9868af79db59a02a929e
SHA100286694f32ec4cbfbc1bc7bfff05cd32a451724
SHA25640f7b37fac44b58fb938deae5c562f6e80988d8dbdd53afa8877ec61799ea678
SHA512722a9183b3a860d35538a6a78ece43ca72c00d69eaddfbcbbf45bb98b79a7010c27c95807381ef410c6c73e1471780b59c10623a3a371ac5e9ebd1e10a72da71
-
/data/data/com.khelo.winindia/app_mph_dex/apk.manager-v1.rizal.xmlFilesize
890KB
MD53558d2f059c6507786eb772f0d9ecd5d
SHA1411383eeb068fd258fcf2bb77d020ae8e2fc0498
SHA256860ac0ff48239e5081d823d2b986914fca4cddfb30828859a0f963cc592a7452
SHA512828a33a1eb312b6883e13ffe58c049a9801d53878fb06b433394085c1b7d18a9362bc617581531cff92d5f8974f824aca9804a69ca365d7e03ba855c02b95600
-
/data/user/0/com.khelo.winindia/app_mph_dex/apk.manager-v1.rizal.xmlFilesize
3.3MB
MD594795eebe4f464938e05f7e6404b1df5
SHA1da3d29d455fbb6f204ba5922c9b91f60dd0121da
SHA256a3dc502fef3b9b5146066f258ef67c7111e063cf889e3af0496d3623a373fbbb
SHA512b305d0864b7e3061840dd85e7f0b505427ec0719b2dca3703bf266132a908f1db46d1235e8f1547fb5e2e96266eeecf10f25b0dfe0e6cb1da6b25389400d252a
-
/storage/emulated/0/Config/sys/apps/log/log-2024-01-01.txtFilesize
25B
MD527845d4ced01d65eb614ba5b0df1f73d
SHA144775c4e982cfc73073cdcc1271936da7a121fdf
SHA256c8e43df7ef007a924551ada6eb1c7587fbe8992677522fa95a444b46dd741187
SHA5129c79244530e594e93905d1845336192e8da8e37345cb0e3365836f14acf9af05100eddaee63e18f5c574306dad42202e41d15acee14a6804646679edba87a17a
-
/storage/emulated/0/Config/sys/apps/log/log-2024-01-01.txtFilesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
/storage/emulated/0/Config/sys/apps/log/log-2024-01-01.txtFilesize
280B
MD5b7a8a9a5edd4b4edee2f5753e6762377
SHA14b98842ef7281b1dc16413f67d0940e80b130682
SHA256a075cf303eb8b4364fd0ce7e1b9032ec6c6a9a0ed22d3a29d3913f4ead62e537
SHA5127203f3e14d950e825998ea617692d437104ec29813ff56a838ccd0ffd5631ad7c3be79bec827034bfa57b1a3cf0cc5bfe8c141e51f77c09253888510844816bb
-
/storage/emulated/0/Config/sys/apps/log/log-2024-01-01.txtFilesize
57B
MD58b781276616b5442597cac39cba526df
SHA1f59cd7b0ff95c49daaba318851809c8b8d3cedeb
SHA2566eb69c1a37be1f39a3838d88e450041268d83760a18bb8d745bb33d88208291d
SHA512d205918a810f0d879a9fdae3a82f54f9da493691ae9e1d95e645486433974ab0d979029c0de0000e63e735cce06e653c7c0d5aa577bc16e037f8a9403c4b6054