spynote | 837b92efaa65bd18df1885dc06401f3edf2609eb51aa85b537f21eda1abc61c5

Target
Craxs rat mobile V1.apk
Size 5.4MB
Sample240211-ck4yradd23
SHA256 837b92efaa65bd18df1885dc06401f3edf2609eb51aa85b537f21eda1abc61c5
MD5 5957b575bb39d2ae9cf18325d754938f
SHA1 2e7f4ce732c1f7f00b10c929bfcc70753693dfc9
SHA512 cd332a7d1d9e1a44794f05e866c42c7d0f23d8b48ad56a59ccda877f6e10617073e55afee4289956dca530a2286ba5d3ab00812b43e6b6026873862a448ff849
SSDEEP 98304:zuq6DHpO1xrQs/y64AJ+IDkaP5LUT2cUxtjnmUKMyhrFZIAFANHg1vTNqE/t:z6DpUFnjkaPxWUXmUKtrFfWNH2L4E1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Craxs rat mobile V1.apk
- Size 5.4MB
- SHA256 837b92efaa65bd18df1885dc06401f3edf2609eb51aa85b537f21eda1abc61c5
- MD5 5957b575bb39d2ae9cf18325d754938f
- SHA1 2e7f4ce732c1f7f00b10c929bfcc70753693dfc9
- SHA512 cd332a7d1d9e1a44794f05e866c42c7d0f23d8b48ad56a59ccda877f6e10617073e55afee4289956dca530a2286ba5d3ab00812b43e6b6026873862a448ff849
- SSDEEP 98304:zuq6DHpO1xrQs/y64AJ+IDkaP5LUT2cUxtjnmUKMyhrFZIAFANHg1vTNqE/t:z6DpUFnjkaPxWUXmUKtrFfWNH2L4E1
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2 behavioral3
- Target
  childapp.apk
- Size 61.1MB
- SHA256 613dfad45a7696818e1fb73d6892bb52cad7231c305f70db1c9cbbbcfab2c76d
- MD5 0b164382ea5279ba6baaa2f0f6fc99af
- SHA1 58bf6ab3f5f854431d14f162e926759aed59e2e5
- SHA512 056e6c41a6bdb0f715a1f46d97da168d135c411dd978295fb73137f2d027f906f1d4601685fa5776f118ec662eee2d85886506237185f44931829ebcab94536c
- SSDEEP 98304:zrp2DuCvLN44WzpF1Cuqmsf5RjaECmzzzBCTW0t4n67Yn:+uCv1WHEugf5gEtzcdb8n
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

banker
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Requests enabling of the accessibility settings.
- Acquires the wake lock
behavioral4 behavioral5 behavioral6

MITRE ATT&CK Matrix

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Loads dropped Dex/Jar

Requests enabling of the accessibility settings.

Acquires the wake lock

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6