Overview

overview

10

Static

static

10

a22f6141cc...c7.apk

android-9-x86

8

a22f6141cc...c7.apk

android-10-x64

8

a22f6141cc...c7.apk

android-11-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a22f6141cc23358e5e9957985ab7591a490c7ccdd73931d83ae25071358a3cc7.bin

  • Size

    748KB

  • Sample

    240313-1xhs2sad2s

  • MD5

    54838da577a8dd4afc1e75dd43b73839

  • SHA1

    940f57d6c15087ba5873bda2b3d8f18f32becc30

  • SHA256

    a22f6141cc23358e5e9957985ab7591a490c7ccdd73931d83ae25071358a3cc7

  • SHA512

    5de5c98f657db8021fd6408e4945bcfb8ca5d3ead0fd7b77efe767a18ee47c6c588ded4ed279eaf45f565921c61b8c0fcb94d8ea9fdc6e5d1f4f1aa939e2037b

  • SSDEEP

    12288:X32aErEla1a8LdeXwhDlUM/5WmpYshXZPbGwidNpgYn:XmaEIla1a6eXQDlUM/5WmD9idNpj

Score
10/10
spynoteandroidbankerdiscoveryprivilege_escalation

Malware Config

Extracted

Family

spynote

C2

0.tcp.eu.ngrok.io:10623

Targets

    • Target

      a22f6141cc23358e5e9957985ab7591a490c7ccdd73931d83ae25071358a3cc7.bin

    • Size

      748KB

    • MD5

      54838da577a8dd4afc1e75dd43b73839

    • SHA1

      940f57d6c15087ba5873bda2b3d8f18f32becc30

    • SHA256

      a22f6141cc23358e5e9957985ab7591a490c7ccdd73931d83ae25071358a3cc7

    • SHA512

      5de5c98f657db8021fd6408e4945bcfb8ca5d3ead0fd7b77efe767a18ee47c6c588ded4ed279eaf45f565921c61b8c0fcb94d8ea9fdc6e5d1f4f1aa939e2037b

    • SSDEEP

      12288:X32aErEla1a8LdeXwhDlUM/5WmpYshXZPbGwidNpgYn:XmaEIla1a6eXQDlUM/5WmD9idNpj

    Score
    8/10
    bankerdiscoveryprivilege_escalation

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

      privilege_escalation

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks