Overview

overview

10

Static

static

10

b6cbc9b7c4...aa.apk

android-9-x86

8

b6cbc9b7c4...aa.apk

android-10-x64

8

b6cbc9b7c4...aa.apk

android-11-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    b6cbc9b7c4fbcf57a4d03acb39d6a7cadd9b6206ca810fdae7e4b896c3c3b6aa.bin
  • Size 760KB
  • Sample240218-1xjeksfd45
  • SHA256 b6cbc9b7c4fbcf57a4d03acb39d6a7cadd9b6206ca810fdae7e4b896c3c3b6aa
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
spynoteandroidbanker

Malware Config

Extracted

Family

  • spynote

C2

  • 4.tcp.eu.ngrok.io:17618

Targets

    • Target
      b6cbc9b7c4fbcf57a4d03acb39d6a7cadd9b6206ca810fdae7e4b896c3c3b6aa.bin
    • Size 760KB
    • SHA256 b6cbc9b7c4fbcf57a4d03acb39d6a7cadd9b6206ca810fdae7e4b896c3c3b6aa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    banker

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      banker

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks