Analysis
-
max time kernel
150s -
max time network
143s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
06-02-2024 07:18
General
-
Target
9421c0e77b615203055f42727833e6de.apk
-
Size
827KB
-
MD5
9421c0e77b615203055f42727833e6de
-
SHA1
33e0f3dc0684be68d32384448beb8059a344be15
-
SHA256
56206203f6381b1274c921c4eb5577e6f96350796a8325be8f29d4d23a682c17
-
SHA512
12735d66572b8405db11d3d25f08d4bc41f4783761eb67205506664eaaafb69f65466b3dcce238057ffb8831e5ec88b9509076341dadfec6286cab9c6802fee2
-
SSDEEP
12288:fubh9rIjqnh7bxLwl6He1DdvPazc+V1CMFspK7lsF6A4R6nWL2XEKs4W+fvVGfy4:fq9rImh7CsEDdqzqMFz86ACkSGVfRz8
Malware Config
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote payload 1 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Tries to add a device administrator. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.android.tester1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.android.tester/app_ded/0ZBW9BvZH2faHgVmWrecjZL1lY1W0NQY.dexFilesize
572KB
MD54565def4512efe74e999abf013c91b2d
SHA1e5cfc824020ce194e3c5e323cfeaf24caaf30ad6
SHA256bcab89c43b0252d44a028c4fa46702c401663d70cf445d0b46c5e68ae3980b27
SHA5127bea9f690e00b8bcecded81a8e48e869328ffb9f04796a99f4aa689f7e45433399d5ba3b748ba69f3303745a028ff78f42359bb475345240496af99e7f552425