Analysis

  • max time kernel
    366s
  • max time network
    382s
  • platform
    android_x64
  • resource
    android-x64-20240221-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
  • submitted
    25-03-2024 18:10

General

  • Target

    https://www.mediafire.com/file/d30u711rj7w1kpm/ready.apk/file

Malware Config

Extracted

Family

spynote

C2

83.30.40.183:6666

Signatures

  • Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

  • Reads the content of photos stored on the user's device. 1 TTPs 4 IoCs
  • Declares broadcast receivers with permission to handle system events 1 IoCs
  • Declares services with permission to bind to the system 3 IoCs
  • Requests dangerous framework permissions 15 IoCs

Processes

  • com.android.chrome
    1⤵
    • Reads the content of photos stored on the user's device.
    PID:5017
  • com.android.chrome
    1⤵
    • Reads the content of photos stored on the user's device.
    PID:5361
  • com.android.chrome
    1⤵
    • Reads the content of photos stored on the user's device.
    PID:5638
  • com.android.chrome
    1⤵
    • Reads the content of photos stored on the user's device.
    PID:6032

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • files/dom-0.html

    Filesize

    325KB

    MD5

    6d9c5883a6c159f108455b19037c359e

    SHA1

    81a9340f7302921b26bce4e08e53cd0c1bdbd11c

    SHA256

    bc58995e340b450774576d19f7b5764c8a5296b306c99e513302e8e318cd2784

    SHA512

    305aa7daae5ee3dbdb0149e26f5e0dc2c317a2aaf8b28406f375d1a13b4733aa5d4d301561112ab59eae13157337d32816081c9237560662b46947d2388e2502

  • files/dom-1.html

    Filesize

    327KB

    MD5

    2dd6b09fd0bb963824f60cd1829e72ab

    SHA1

    63d6d1e72589c1c81e3f812662a7ef4525a30f3a

    SHA256

    29a4f193936b58ded597b2cc914a5a2aa41598eb679267e068134593fe6b0af6

    SHA512

    a15ddfec3e7d1e03285dc16f700ef94db45e5cd3ac34221cdb9fb2c29cabd8936c64420f22c8c18081c7d51fd054193a8827dbe7441b99a8a177d62b12c6c972

  • /storage/emulated/0/Android/data/com.android.chrome/files/Download/Unconfirmed 351779.crdownload

    Filesize

    320KB

    MD5

    1f87977b94c51f7b8ab6a954ea1f7620

    SHA1

    83902a250bdc4856dc4fe7d2b4a29d0f85977484

    SHA256

    9b95854d18f7cf0b9bceb3b63d39df88bd322499de4a222d5f0ef218c6e62e79

    SHA512

    61694cf63c1b316c56d93425134cffed78e1af857b07d46b2d6179f5d019e240a1b4cf6a725cba0af688411a6ec684d6c2bcbd111663cfb44a173381cc3091f4

  • /storage/emulated/0/Download/ready (1).apk

    Filesize

    1.9MB

    MD5

    668bf1092550455df61108228ebc2d50

    SHA1

    eaae1fe1f8b3f71fabf632929add4461dcec505a

    SHA256

    accb0cdb8ea7370e5ab75f2277cd5d302f1ddce36850c1018e124a8d4196d97d

    SHA512

    34f183762725260aba52f0ab3456727d4bacbc5b19e057df12351e00eafd009025d4a672ef75857ed841c601b7123a089005c2f6f1b625a455c17afaa72184d6

  • /storage/emulated/0/Download/ready (1).apk

    Filesize

    4.6MB

    MD5

    dcee97a590fedde0ce60944d7fd62477

    SHA1

    82664a4d6870087385ef598bf1fa2f58f4d74269

    SHA256

    ca564818231e1175d73519b6af9b2413864c81fe756767f5871cf166e3104f44

    SHA512

    db00b42688cfb09f15d4fc4df2a5298224b5ae02a3c22321274fbab0d22ad5deb294c56a7cce7983d668951b267bc267fffcd0b0c8e05a0899f92964ba3b7528