Overview

overview

10

Static

static

10

9ad6d8d10f...da.apk

android-9-x86

8

9ad6d8d10f...da.apk

android-10-x64

8

9ad6d8d10f...da.apk

android-11-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ad6d8d10f0da32ff294640e0b1d2cb2300badaa49d0d6cb4daaa40512c106da.bin

  • Size

    760KB

  • Sample

    240410-1xlvpscf26

  • MD5

    c974ce6623837f755f24a61562ca2bff

  • SHA1

    4d6ca706358838c1e52c0b8210968a062a01e73e

  • SHA256

    9ad6d8d10f0da32ff294640e0b1d2cb2300badaa49d0d6cb4daaa40512c106da

  • SHA512

    2d4945c9c4a6ed5818d69d00be4a760f316e4c2f35f4694fa1fc0b9ac9bb8d3d17431513f2890200bbbb52abfbf6ab465d7baa7474b4b6f24a62e5c7516565a6

  • SSDEEP

    12288:kciBMHpgfvNldadNbubVRADn+JBjkAgMsFMjIP:khVfvNKdNibVRwn+jFsFd

Score
10/10
spynoteandroidbankerdiscoveryevasionpersistence

Malware Config

Extracted

Family

spynote

C2

joined-solved.gl.at.ply.gg:14355

Targets

    • Target

      9ad6d8d10f0da32ff294640e0b1d2cb2300badaa49d0d6cb4daaa40512c106da.bin

    • Size

      760KB

    • MD5

      c974ce6623837f755f24a61562ca2bff

    • SHA1

      4d6ca706358838c1e52c0b8210968a062a01e73e

    • SHA256

      9ad6d8d10f0da32ff294640e0b1d2cb2300badaa49d0d6cb4daaa40512c106da

    • SHA512

      2d4945c9c4a6ed5818d69d00be4a760f316e4c2f35f4694fa1fc0b9ac9bb8d3d17431513f2890200bbbb52abfbf6ab465d7baa7474b4b6f24a62e5c7516565a6

    • SSDEEP

      12288:kciBMHpgfvNldadNbubVRADn+JBjkAgMsFMjIP:khVfvNKdNibVRwn+jFsFd

    Score
    8/10
    bankerdiscoveryevasionpersistence

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Requests enabling of the accessibility settings.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks