spynote | ce2a872bd0c05cf4b0dc890b84f83ce44ce7cfd51be1e5b06c520c342de56bb8

General

Target

123.apk
Size

728KB
Sample

240422-ssvytacf98
MD5

ed50ee1a0d62659e47d3a2c96d41ed70
SHA1

30763093d9f89e4e888d14fb82084d503e9c6588
SHA256

ce2a872bd0c05cf4b0dc890b84f83ce44ce7cfd51be1e5b06c520c342de56bb8
SHA512

b8377ad2d3d2018052e110467aeba736115704c3f8287b939a86d2cedd642ca02069817546156d86da80cda8f40dc97235f6758376bf09928181ade64981a8da
SSDEEP

12288:0ylrYHLbPr19trCNhGUd1w154JMGRiusT3cgtN0Frm/6Rq21OgHsWVfrVQsZtWDq:0owpjeNhzd1wmPAHT3SFrm/GNLfjQbN0

Score

10^/10

Malware Config

Extracted

Family

spynote

C2

158.178.197.18:34737

Targets

- Target
  
  123.apk
- Size
  
  728KB
- MD5
  
  ed50ee1a0d62659e47d3a2c96d41ed70
- SHA1
  
  30763093d9f89e4e888d14fb82084d503e9c6588
- SHA256
  
  ce2a872bd0c05cf4b0dc890b84f83ce44ce7cfd51be1e5b06c520c342de56bb8
- SHA512
  
  b8377ad2d3d2018052e110467aeba736115704c3f8287b939a86d2cedd642ca02069817546156d86da80cda8f40dc97235f6758376bf09928181ade64981a8da
- SSDEEP
  
  12288:0ylrYHLbPr19trCNhGUd1w154JMGRiusT3cgtN0Frm/6Rq21OgHsWVfrVQsZtWDq:0owpjeNhzd1wmPAHT3SFrm/GNLfjQbN0
Score

8^/10

collection credential_access discovery evasion persistence stealth trojan impact
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Removes its main activity from the application launcher
  stealth trojan evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Makes use of the framework's Accessibility service

Removes its main activity from the application launcher

Checks CPU information

Checks memory information

Makes use of the framework's foreground persistence service

Obtains sensitive information copied to the device clipboard

Queries the mobile country code (MCC)

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests enabling of the accessibility settings.

Acquires the wake lock

Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3