Overview

overview

10

Static

static

10

xxx_Dropper.apk

android-10-x64

1

childapp.apk

android-10-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    xxx_Dropper.apk

  • Size

    5.3MB

  • Sample

    240409-da9lxscc47

  • MD5

    12309f410c5b76a7d8003c82086dd7ac

  • SHA1

    186f9f241a0e74a68c19090643b44dda456a0ad9

  • SHA256

    27cbb8480c36ce717e8c9044e51663e7df5bca937a54c68fd79b18b1b5d61fcc

  • SHA512

    dec0c9f76cd691d36a1407a695d545bc0f9357d79b5a51ae25ee5a2629b71a2fac1765a5333f7a4e55b25d2422b0f4333b9564d560aa66135f0ceeeadc760aa2

  • SSDEEP

    98304:4QdO+s7oXCyAE/tLY7cQSAqnlfK8LUxSko7wN0O8pCxk2ax9:4WInREJ8cvKWUxSk9N38pCxk2A

Score
10/10
spynoteandroidbankercollectiondiscoveryevasionpersistence

Malware Config

Targets

    • Target

      xxx_Dropper.apk

    • Size

      5.3MB

    • MD5

      12309f410c5b76a7d8003c82086dd7ac

    • SHA1

      186f9f241a0e74a68c19090643b44dda456a0ad9

    • SHA256

      27cbb8480c36ce717e8c9044e51663e7df5bca937a54c68fd79b18b1b5d61fcc

    • SHA512

      dec0c9f76cd691d36a1407a695d545bc0f9357d79b5a51ae25ee5a2629b71a2fac1765a5333f7a4e55b25d2422b0f4333b9564d560aa66135f0ceeeadc760aa2

    • SSDEEP

      98304:4QdO+s7oXCyAE/tLY7cQSAqnlfK8LUxSko7wN0O8pCxk2ax9:4WInREJ8cvKWUxSk9N38pCxk2A

    Score
    1/10
    behavioral1

    • Target

      childapp.apk

    • Size

      4.4MB

    • MD5

      6b7991c3b97889f06ad8b1127bf364af

    • SHA1

      fea84c2cd3996ed6828d3736e2369e19c0552c2c

    • SHA256

      bb3292f6a888f4e7c90177b260b473d8fa5276418110cedad32f9cf90ccd693e

    • SHA512

      d9532e43656ca0fc8d0f6014c24878ddee7eccfe16199237218a3f6d98d98639c34be183b2bb474a60e6ee4ef876e88342f77adcbbcd0e8bc76498e492359162

    • SSDEEP

      98304:4CmAQe+jkBqvrugXE5VmzEzBuTL0twSg0mf:4CmqgXCYz90NAf

    Score
    8/10
    bankercollectiondiscoveryevasionpersistence

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasion

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Queries account information for other applications stored on the device.

      Application may abuse the framework's APIs to collect account information stored on the device.

      collection

    • Acquires the wake lock

    behavioral2

MITRE ATT&CK Matrix

Tasks