spynote | 0a399c83c1dcefe7901642e1e316f963eb2e0950ac3b0125ed1dd7c4d69d0f1a

Analysis

max time kernel
4s
max time network
186s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
17-05-2024 18:25

Target

6947ff1be3734aadceb5f294d1f187a5.apk
Size

610KB
MD5

6947ff1be3734aadceb5f294d1f187a5
SHA1

321682c8395216b6f71ac1f4a1188040bbddfeb4
SHA256

0a399c83c1dcefe7901642e1e316f963eb2e0950ac3b0125ed1dd7c4d69d0f1a
SHA512

5e13e697ac55b7c7151b6c1ad54f0dc9e0d1c15906deca54c1d0c30f21fab26e607a77a0b1e02d7ef86137c560b238374baa13a0a9d4b0ab17f0bcc1adb85be6
SSDEEP

12288:TH7aga+gYU3BKfPbKdla+OAnycLhuDoQkvbUN:D7Y+gYU3BK3wN9nTOoQk4N

Score

10^/10

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex	family_spynote

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

GOOD.BYE.GOOGLE

ioc	pid	process
/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex	4524	GOOD.BYE.GOOGLE
/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex	4524	GOOD.BYE.GOOGLE

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

GOOD.BYE.GOOGLE

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground GOOD.BYE.GOOGLE

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	GOOD.BYE.GOOGLE

GOOD.BYE.GOOGLE
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
PID:4524

/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex
Filesize
572KB

MD5
4565def4512efe74e999abf013c91b2d

SHA1
e5cfc824020ce194e3c5e323cfeaf24caaf30ad6

SHA256
bcab89c43b0252d44a028c4fa46702c401663d70cf445d0b46c5e68ae3980b27

SHA512
7bea9f690e00b8bcecded81a8e48e869328ffb9f04796a99f4aa689f7e45433399d5ba3b748ba69f3303745a028ff78f42359bb475345240496af99e7f552425

Download Submit
/storage/emulated/0/Android Telegram update/base.apk
Filesize
1KB

MD5
bd8b9e1a0b2ddd4d69cf7feb24335805

SHA1
30bb3cedb48f6c87cd07beda3ea0e0b6f12199f5

SHA256
9852dfce6aeb8947eeed3a8ecc65bc98725b0a288c2ebb5fa0ff92c214c64358

SHA512
592f5318de40e477434ce88f1be52e60781702716aef358920112328d221c518ef0ba2ca7e18076f5dd50e6dd73027071d9a105cb3ad68aae891c8bd3eca0501

Download Submit