spynote | c19cf001efb893cfb4f3aedb1c4c3771ce8419d3838e1bc399e88a12b583b28c

Analysis

max time kernel
175s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
17-05-2024 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66c4513025128719dda018820cc0987e_1.apk
Size

3.0MB
MD5

66c4513025128719dda018820cc0987e
SHA1

4dcc2d9ef4921b3eb4e4dc72dd3716520d558102
SHA256

c19cf001efb893cfb4f3aedb1c4c3771ce8419d3838e1bc399e88a12b583b28c
SHA512

dd5ed77e8f110ceafe036adcf673dfb77b46e78d23815abcf25cbe08ad6631bf6c348bdab49ca497ed44c77c1ad0b19425fd8ed44063cb1da8dbe9b84fab49bd
SSDEEP

49152:HYvtHWc3kQdaWWce2fFeeC6K6iZHyqDmLJTsY2424rTOoQE2jvKuAz:Hodz3kQAW3ft9CH79dD2JNvS+

Score

10^/10

spynote banker discovery evasion infostealer persistence rat trojan

Malware Config

Signatures

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 2 IoCs

Processes:

resource	yara_rule
/data/data/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex	family_spynote
/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex	family_spynote

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

GOOD.BYE.GOOGLE/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex	4239	GOOD.BYE.GOOGLE
/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex	4273	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex	4239	GOOD.BYE.GOOGLE

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

GOOD.BYE.GOOGLE

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground GOOD.BYE.GOOGLE
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

GOOD.BYE.GOOGLE

description ioc process

Framework service call android.app.IActivityManager.registerReceiver GOOD.BYE.GOOGLE

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	GOOD.BYE.GOOGLE

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	GOOD.BYE.GOOGLE

Requests dangerous framework permissions 2 IoCs

Processes:

description	ioc
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

GOOD.BYE.GOOGLE
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4239

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4273

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex
Filesize
572KB

MD5
4565def4512efe74e999abf013c91b2d

SHA1
e5cfc824020ce194e3c5e323cfeaf24caaf30ad6

SHA256
bcab89c43b0252d44a028c4fa46702c401663d70cf445d0b46c5e68ae3980b27

SHA512
7bea9f690e00b8bcecded81a8e48e869328ffb9f04796a99f4aa689f7e45433399d5ba3b748ba69f3303745a028ff78f42359bb475345240496af99e7f552425

Download Submit
/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex
Filesize
572KB

MD5
9016471b31bc084f452d0ef71a6d239f

SHA1
2bfdd23a29b923f31f20f5f9af4315a6b071af99

SHA256
90ce52f7fe0678205338ce69adebd0ad5a78e085c20c0d18f5792b6158b38f47

SHA512
762e1c5d9773e56997632906328ab4c14d8984a270009986f1cbb1ee6997fcfeefe451a4aaca11ed5dfa2a1e4f5d5f9446af305ea19df4c4f23d458d545c5a89

Download Submit
/storage/emulated/0/Android Covid/base.apk
Filesize
2.6MB

MD5
9f9098cd949fc90785c3fe1afccdca3e

SHA1
c28083fd26c3067f1c29755f450dcba077212533

SHA256
e441af83f445a1af90e738e4ad2ba5285304a3e9a2031013b887948dab4ffafd

SHA512
26ed74d1f0089133c082ccee2ce02c799b0342aaceadfd5223bb4135cb980eb743797bf5e64b4ec97f7a68cbac58c192027dcb05a029b064dbb5aaf26654432d

Download Submit