spynote | 56206203f6381b1274c921c4eb5577e6f96350796a8325be8f29d4d23a682c17

Analysis

max time kernel
149s
max time network
138s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
06-02-2024 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9421c0e77b615203055f42727833e6de.apk
Size

827KB
MD5

9421c0e77b615203055f42727833e6de
SHA1

33e0f3dc0684be68d32384448beb8059a344be15
SHA256

56206203f6381b1274c921c4eb5577e6f96350796a8325be8f29d4d23a682c17
SHA512

12735d66572b8405db11d3d25f08d4bc41f4783761eb67205506664eaaafb69f65466b3dcce238057ffb8831e5ec88b9509076341dadfec6286cab9c6802fee2
SSDEEP

12288:fubh9rIjqnh7bxLwl6He1DdvPazc+V1CMFspK7lsF6A4R6nWL2XEKs4W+fvVGfy4:fq9rImh7CsEDdqzqMFz86ACkSGVfRz8

Score

10^/10

spynote banker infostealer rat trojan

Malware Config

Signatures

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 2 IoCs

Processes:

resource	yara_rule
/data/data/com.android.tester/app_ded/SftiBsZ9txcirqfyQPILcrfwQinZSbXd.dex	family_spynote
/data/user/0/com.android.tester/app_ded/SftiBsZ9txcirqfyQPILcrfwQinZSbXd.dex	family_spynote

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
banker

Processes:

com.android.tester

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.android.tester

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.android.tester

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.android.tester/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.android.tester/app_ded/SftiBsZ9txcirqfyQPILcrfwQinZSbXd.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.android.tester/app_ded/oat/x86/SftiBsZ9txcirqfyQPILcrfwQinZSbXd.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.android.tester/app_ded/SftiBsZ9txcirqfyQPILcrfwQinZSbXd.dex	4199	com.android.tester
/data/user/0/com.android.tester/app_ded/SftiBsZ9txcirqfyQPILcrfwQinZSbXd.dex	4225	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.android.tester/app_ded/SftiBsZ9txcirqfyQPILcrfwQinZSbXd.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.android.tester/app_ded/oat/x86/SftiBsZ9txcirqfyQPILcrfwQinZSbXd.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.android.tester/app_ded/SftiBsZ9txcirqfyQPILcrfwQinZSbXd.dex	4199	com.android.tester

Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.android.tester

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.android.tester
Tries to add a device administrator. 1 IoCs

Processes:

com.android.tester

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN com.android.tester
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.android.tester

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.android.tester

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.android.tester

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.android.tester

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.android.tester

com.android.tester
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4199

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.android.tester/app_ded/SftiBsZ9txcirqfyQPILcrfwQinZSbXd.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.android.tester/app_ded/oat/x86/SftiBsZ9txcirqfyQPILcrfwQinZSbXd.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4225

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.android.tester/app_ded/SftiBsZ9txcirqfyQPILcrfwQinZSbXd.dex

Filesize
572KB

MD5
4565def4512efe74e999abf013c91b2d

SHA1
e5cfc824020ce194e3c5e323cfeaf24caaf30ad6

SHA256
bcab89c43b0252d44a028c4fa46702c401663d70cf445d0b46c5e68ae3980b27

SHA512
7bea9f690e00b8bcecded81a8e48e869328ffb9f04796a99f4aa689f7e45433399d5ba3b748ba69f3303745a028ff78f42359bb475345240496af99e7f552425

Download Submit
/data/user/0/com.android.tester/app_ded/SftiBsZ9txcirqfyQPILcrfwQinZSbXd.dex

Filesize
572KB

MD5
9016471b31bc084f452d0ef71a6d239f

SHA1
2bfdd23a29b923f31f20f5f9af4315a6b071af99

SHA256
90ce52f7fe0678205338ce69adebd0ad5a78e085c20c0d18f5792b6158b38f47

SHA512
762e1c5d9773e56997632906328ab4c14d8984a270009986f1cbb1ee6997fcfeefe451a4aaca11ed5dfa2a1e4f5d5f9446af305ea19df4c4f23d458d545c5a89

Download Submit