spynote | 61ef15e9eccee437915a643c86e7f5049bcee9c439360a0a9cd4818adb98fb26

General

Target

61ef15e9eccee437915a643c86e7f5049bcee9c439360a0a9cd4818adb98fb26.apk
Size

18.3MB
Sample

240526-bftfsahg68
MD5

051916df0c9afa5bb89b4d4771f291f7
SHA1

49fc19b18617e39f788b93846d679cfe4cc7963f
SHA256

61ef15e9eccee437915a643c86e7f5049bcee9c439360a0a9cd4818adb98fb26
SHA512

167bef68e5eb04f438d93a08e098ef1306d674ee252bd93a976732b4f1c1e8a036b9054ea2798052af57fc47315720753061f69f1280b76ec06349fe05a6f9c4
SSDEEP

98304:+jwaGeWClCZmcsPS75miKq0T0Q797HmzzzBGTr0t4d:PaZCZwPSYiKq0gY0zgUy

Score

10^/10

Malware Config

Extracted

Family

spynote

C2

botuser0.duckdns.org:1337

Targets

- Target
  
  61ef15e9eccee437915a643c86e7f5049bcee9c439360a0a9cd4818adb98fb26.apk
- Size
  
  18.3MB
- MD5
  
  051916df0c9afa5bb89b4d4771f291f7
- SHA1
  
  49fc19b18617e39f788b93846d679cfe4cc7963f
- SHA256
  
  61ef15e9eccee437915a643c86e7f5049bcee9c439360a0a9cd4818adb98fb26
- SHA512
  
  167bef68e5eb04f438d93a08e098ef1306d674ee252bd93a976732b4f1c1e8a036b9054ea2798052af57fc47315720753061f69f1280b76ec06349fe05a6f9c4
- SSDEEP
  
  98304:+jwaGeWClCZmcsPS75miKq0T0Q797HmzzzBGTr0t4d:PaZCZwPSYiKq0gY0zgUy
Score

8^/10

banker collection credential_access discovery evasion execution persistence stealth trojan
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
- Schedules tasks to execute at a specified time
  Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
  execution persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Loads dropped Dex/Jar

Makes use of the framework's foreground persistence service

Registers a broadcast receiver at runtime (usually for listening for system events)

Acquires the wake lock

Requests disabling of battery optimizations (often used to enable hiding in the background).

Schedules tasks to execute at a specified time

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3