spynote | def264293c2a15a5e1f0da02f5167ded0db3eb339c3db1e7bd698489d60eb2f3 | Triage

Sharing

General

Target

def264293c2a15a5e1f0da02f5167ded0db3eb339c3db1e7bd698489d60eb2f3.apk
Size

4.4MB
Sample

240421-kjydksff2s
MD5

75e98ac7cb4104e647f33462c5ece917
SHA1

a1207e642277ed29672abf45cd6a038661c3c7ed
SHA256

def264293c2a15a5e1f0da02f5167ded0db3eb339c3db1e7bd698489d60eb2f3
SHA512

cc8cb11c4b9dae5e726c4d4b1c1786cd61c87776b16931ae65f1cbe564989af051787af267725b9bda3918afa877db0797c01fea12fae00360a50b5479e54ef7
SSDEEP

98304:TrOAylSsqBxPMsUDyskAs24RiJomz0zBkTd0tYlqyC:nasZLUWHAsJwJXzbSCw

Score

10^/10

spynote android banker collection credential_access discovery evasion persistence

Malware Config

Targets

- Target
  
  def264293c2a15a5e1f0da02f5167ded0db3eb339c3db1e7bd698489d60eb2f3.apk
- Size
  
  4.4MB
- MD5
  
  75e98ac7cb4104e647f33462c5ece917
- SHA1
  
  a1207e642277ed29672abf45cd6a038661c3c7ed
- SHA256
  
  def264293c2a15a5e1f0da02f5167ded0db3eb339c3db1e7bd698489d60eb2f3
- SHA512
  
  cc8cb11c4b9dae5e726c4d4b1c1786cd61c87776b16931ae65f1cbe564989af051787af267725b9bda3918afa877db0797c01fea12fae00360a50b5479e54ef7
- SSDEEP
  
  98304:TrOAylSsqBxPMsUDyskAs24RiJomz0zBkTd0tYlqyC:nasZLUWHAsJwJXzbSCw
Score

8^/10

banker collection credential_access discovery evasion persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

Software Discovery

Security Software Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

bankercollectioncredential_accessdiscoveryevasionpersistence

behavioral2

bankercollectioncredential_accessdiscoveryevasionpersistence

behavioral3

bankercollectioncredential_accessdiscoveryevasionpersistence