Overview

overview

10

Static

static

10

3276943daf...36.apk

android-9-x86

8

3276943daf...36.apk

android-10-x64

8

3276943daf...36.apk

android-11-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4039490e886c80ad068cf1637ca675fcad9e089b767179fd5c516bbf3330332

  • Size

    468KB

  • Sample

    240515-ld6cnsba21

  • MD5

    5ab05eb1af2063caf0c581818aa43bbe

  • SHA1

    d1943c5dee87dc640350af25ca86e56a97b7c270

  • SHA256

    f4039490e886c80ad068cf1637ca675fcad9e089b767179fd5c516bbf3330332

  • SHA512

    a8e9ad1fa2c3f6458367f754f537038a09cc45b918b64f1c206e6373fbb267e4448af2f0e809c7e4d9c821c17c1981092db5d9d3af083b2cccb35d379884148e

  • SSDEEP

    12288:ITFTJgeujCVXqSAsYy0mtXL6zGG3mQrkF/QOKEcKPctg8k:ITr1kyXeyG3mQrCQOfRPQnk

Score
10/10
spynoteandroidbankerdiscoveryevasionpersistence

Malware Config

Extracted

Family

spynote

C2

4.194.25.153:5214

Targets

    • Target

      3276943dafdd603863aaf4b33a6ea3569dba91b1fac81b6bb4b454ffbe99e936.apk

    • Size

      748KB

    • MD5

      bf22cb5e4bc8cac7a1ddbb6dfc9077d3

    • SHA1

      4076df1e93acf64e48c41428a7468f097eb312ca

    • SHA256

      3276943dafdd603863aaf4b33a6ea3569dba91b1fac81b6bb4b454ffbe99e936

    • SHA512

      44c877ba36b97735fc9b04e0f74d10e9f462e4275ca06e597375c2fb7db3c4f67e275c51f97a3af7bff071644ad76a53b24d0daedc1d6df918f3453e8428bf26

    • SSDEEP

      12288:6JS+a1a8Lzey5N0VHJ5Jz5WmpYshXZPbGwidNpg/:kXa1ameyH017Jz5WmD9idNpA

    Score
    8/10
    bankerdiscoveryevasionpersistence

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Registers a broadcast receiver at runtime (usually for listening for system events)

      persistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks