spynote | 0a399c83c1dcefe7901642e1e316f963eb2e0950ac3b0125ed1dd7c4d69d0f1a

Analysis

max time kernel
3s
max time network
182s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
17/05/2024, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6947ff1be3734aadceb5f294d1f187a5.apk
Size

610KB
MD5

6947ff1be3734aadceb5f294d1f187a5
SHA1

321682c8395216b6f71ac1f4a1188040bbddfeb4
SHA256

0a399c83c1dcefe7901642e1e316f963eb2e0950ac3b0125ed1dd7c4d69d0f1a
SHA512

5e13e697ac55b7c7151b6c1ad54f0dc9e0d1c15906deca54c1d0c30f21fab26e607a77a0b1e02d7ef86137c560b238374baa13a0a9d4b0ab17f0bcc1adb85be6
SSDEEP

12288:TH7aga+gYU3BKfPbKdla+OAnycLhuDoQkvbUN:D7Y+gYU3BK3wN9nTOoQk4N

Score

10^/10

spynote banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_spynote

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex	5164	GOOD.BYE.GOOGLE
/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex	5164	GOOD.BYE.GOOGLE

GOOD.BYE.GOOGLE
1⤵
- Loads dropped Dex/Jar
PID:5164

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex

Filesize
572KB

MD5
4565def4512efe74e999abf013c91b2d

SHA1
e5cfc824020ce194e3c5e323cfeaf24caaf30ad6

SHA256
bcab89c43b0252d44a028c4fa46702c401663d70cf445d0b46c5e68ae3980b27

SHA512
7bea9f690e00b8bcecded81a8e48e869328ffb9f04796a99f4aa689f7e45433399d5ba3b748ba69f3303745a028ff78f42359bb475345240496af99e7f552425

Download Submit
/storage/emulated/0/Android Telegram update/base.apk

Filesize
1KB

MD5
bd8b9e1a0b2ddd4d69cf7feb24335805

SHA1
30bb3cedb48f6c87cd07beda3ea0e0b6f12199f5

SHA256
9852dfce6aeb8947eeed3a8ecc65bc98725b0a288c2ebb5fa0ff92c214c64358

SHA512
592f5318de40e477434ce88f1be52e60781702716aef358920112328d221c518ef0ba2ca7e18076f5dd50e6dd73027071d9a105cb3ad68aae891c8bd3eca0501

Download Submit