spynote | c19cf001efb893cfb4f3aedb1c4c3771ce8419d3838e1bc399e88a12b583b28c

Analysis

max time kernel
3s
max time network
186s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
17/05/2024, 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66c4513025128719dda018820cc0987e_1.apk
Size

3.0MB
MD5

66c4513025128719dda018820cc0987e
SHA1

4dcc2d9ef4921b3eb4e4dc72dd3716520d558102
SHA256

c19cf001efb893cfb4f3aedb1c4c3771ce8419d3838e1bc399e88a12b583b28c
SHA512

dd5ed77e8f110ceafe036adcf673dfb77b46e78d23815abcf25cbe08ad6631bf6c348bdab49ca497ed44c77c1ad0b19425fd8ed44063cb1da8dbe9b84fab49bd
SSDEEP

49152:HYvtHWc3kQdaWWce2fFeeC6K6iZHyqDmLJTsY2424rTOoQE2jvKuAz:Hodz3kQAW3ft9CH79dD2JNvS+

Score

10^/10

spynote banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_spynote

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex	5100	GOOD.BYE.GOOGLE
/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex	5100	GOOD.BYE.GOOGLE

Requests dangerous framework permissions 2 IoCs

description	ioc
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

GOOD.BYE.GOOGLE
1⤵
- Loads dropped Dex/Jar
PID:5100

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex

Filesize
572KB

MD5
4565def4512efe74e999abf013c91b2d

SHA1
e5cfc824020ce194e3c5e323cfeaf24caaf30ad6

SHA256
bcab89c43b0252d44a028c4fa46702c401663d70cf445d0b46c5e68ae3980b27

SHA512
7bea9f690e00b8bcecded81a8e48e869328ffb9f04796a99f4aa689f7e45433399d5ba3b748ba69f3303745a028ff78f42359bb475345240496af99e7f552425

Download Submit
/storage/emulated/0/Android Covid/base.apk

Filesize
2.6MB

MD5
9f9098cd949fc90785c3fe1afccdca3e

SHA1
c28083fd26c3067f1c29755f450dcba077212533

SHA256
e441af83f445a1af90e738e4ad2ba5285304a3e9a2031013b887948dab4ffafd

SHA512
26ed74d1f0089133c082ccee2ce02c799b0342aaceadfd5223bb4135cb980eb743797bf5e64b4ec97f7a68cbac58c192027dcb05a029b064dbb5aaf26654432d

Download Submit