Overview

overview

10

Static

static

10

0e866993a1...4d.apk

android-9-x86

8

0e866993a1...4d.apk

android-10-x64

8

0e866993a1...4d.apk

android-11-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e866993a124d1add425d9560ef64880097f87c2110ff37f9f622a0e1972f04d.bin

  • Size

    783KB

  • Sample

    240417-1yt8gagg3w

  • MD5

    e36a0ed6779d45a40ed899a658a4e4a0

  • SHA1

    b39f2671e3b98246be21c6a101d908ef6d0a1152

  • SHA256

    0e866993a124d1add425d9560ef64880097f87c2110ff37f9f622a0e1972f04d

  • SHA512

    2866a593bb2c110f7ad5a0d7c070f389bf2a3b0353e54091c65b3a4c7bba7ab27267d64e5daaa9bf5b945997f531612826fe5b4b035bfb3f017634b4cd39354a

  • SSDEEP

    12288:/EsQ5WmpYshXZPbGwidNpgKCiV5Uf6AvyRFva1a8LVenKI:/k5WmD9idNp1CiV5kavva1aKenP

Score
10/10
spynoteandroidbankerdiscoveryevasionpersistence

Malware Config

Extracted

Family

spynote

C2

for-nails.gl.at.ply.gg:33645

Targets

    • Target

      0e866993a124d1add425d9560ef64880097f87c2110ff37f9f622a0e1972f04d.bin

    • Size

      783KB

    • MD5

      e36a0ed6779d45a40ed899a658a4e4a0

    • SHA1

      b39f2671e3b98246be21c6a101d908ef6d0a1152

    • SHA256

      0e866993a124d1add425d9560ef64880097f87c2110ff37f9f622a0e1972f04d

    • SHA512

      2866a593bb2c110f7ad5a0d7c070f389bf2a3b0353e54091c65b3a4c7bba7ab27267d64e5daaa9bf5b945997f531612826fe5b4b035bfb3f017634b4cd39354a

    • SSDEEP

      12288:/EsQ5WmpYshXZPbGwidNpgKCiV5Uf6AvyRFva1a8LVenKI:/k5WmD9idNp1CiV5kavva1aKenP

    Score
    8/10
    bankerdiscoveryevasionpersistence

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Requests enabling of the accessibility settings.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks