Overview

overview

10

Static

static

6

48dae89653...dc.apk

android-9-x86

10

48dae89653...dc.apk

android-10-x64

10

48dae89653...dc.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    48dae89653161e7c3e4829d5451702dc

  • Size

    3.0MB

  • Sample

    240517-wz6wface95

  • MD5

    48dae89653161e7c3e4829d5451702dc

  • SHA1

    213b7f8c3f26a87b116927143289886742b979a1

  • SHA256

    78e669d3b20e5f1f33985f7228bf6a9410f61cb949fc0e9df5379537d54f981c

  • SHA512

    a07bc275d1e2cbc9da8ee789f4bec25e6846a8d0acab7479953fc45589165ba694e89de38241a0f8ecabe962f75d589ac4eae16e9d20d4539da6ffb46640189a

  • SSDEEP

    49152:ok/FTOoQl1Wc3kQdaWWce2Te6ECrYvEVZNap5HbGO0wnREZvDv:oOFSHz3kQAW3fTdEpMnsPbN9RO

Score
10/10
spynoteandroidbankerdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      48dae89653161e7c3e4829d5451702dc

    • Size

      3.0MB

    • MD5

      48dae89653161e7c3e4829d5451702dc

    • SHA1

      213b7f8c3f26a87b116927143289886742b979a1

    • SHA256

      78e669d3b20e5f1f33985f7228bf6a9410f61cb949fc0e9df5379537d54f981c

    • SHA512

      a07bc275d1e2cbc9da8ee789f4bec25e6846a8d0acab7479953fc45589165ba694e89de38241a0f8ecabe962f75d589ac4eae16e9d20d4539da6ffb46640189a

    • SSDEEP

      49152:ok/FTOoQl1Wc3kQdaWWce2Te6ECrYvEVZNap5HbGO0wnREZvDv:oOFSHz3kQAW3fTdEpMnsPbN9RO

    Score
    10/10
    spynotebankerdiscoveryevasionimpactinfostealerpersistencerattrojan

    • Spynote

      Spynote is a Remote Access Trojan first seen in 2017.

      bankertrojaninfostealerratspynote

    • Spynote payload

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Registers a broadcast receiver at runtime (usually for listening for system events)

      persistence

    • Requests dangerous framework permissions

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks