General
-
Target
app.apk
-
Size
74.4MB
-
Sample
240418-nnr9xabf43
-
MD5
e53c10d713133619cc99c4def38c6f70
-
SHA1
64baafca4a717b16b3da2fa4c8fc34f05eba8176
-
SHA256
6c60af5424a82c7eb06d5e6db79c7b173d6a2cbcd31cf6f715112b34fbd8a22c
-
SHA512
ef1043410a18393228af2241b7cef5bee3545a35c1582632e865ed558c1f946db5a2392f2d9bbaa4054fab26458a3902c3cac5e84b9f09bcf1a2bcd0c38f6528
-
SSDEEP
786432:kuVND3HAxPwLbDKU/7xSGdF1Ck58Fr1cxg4szJh5oa:kuVJH6wb//rmFr1+cJ
Malware Config
Extracted
spynote
3.96.109.127:7771
Targets
-
-
Target
app.apk
-
Size
74.4MB
-
MD5
e53c10d713133619cc99c4def38c6f70
-
SHA1
64baafca4a717b16b3da2fa4c8fc34f05eba8176
-
SHA256
6c60af5424a82c7eb06d5e6db79c7b173d6a2cbcd31cf6f715112b34fbd8a22c
-
SHA512
ef1043410a18393228af2241b7cef5bee3545a35c1582632e865ed558c1f946db5a2392f2d9bbaa4054fab26458a3902c3cac5e84b9f09bcf1a2bcd0c38f6528
-
SSDEEP
786432:kuVND3HAxPwLbDKU/7xSGdF1Ck58Fr1cxg4szJh5oa:kuVJH6wb//rmFr1+cJ
Score8/10-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Acquires the wake lock
-