Overview

overview

10

Static

static

10

febb552943...a1.apk

android-9-x86

8

febb552943...a1.apk

android-10-x64

8

febb552943...a1.apk

android-11-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    febb5529431d6962450cc7a8b6dc0a3bc296f3677b306d77a19b8c82d681dba1.bin

  • Size

    760KB

  • Sample

    240602-3b8hpaag7w

  • MD5

    508929d723ef460b923050a001f5ef4e

  • SHA1

    e627c2a0b49756201d25d4399f2acae8306e40d9

  • SHA256

    febb5529431d6962450cc7a8b6dc0a3bc296f3677b306d77a19b8c82d681dba1

  • SHA512

    59efdb6af3bc3fa24af109acfe6960b33f1cf531519e1bace6b7f05365f1c8180f7c7de3cbc9503750d715cde88157c3ee3024401316325491aa6ca0763c0f19

  • SSDEEP

    12288:/PBJa1a8Lden13Il9Gw5WmpYshXZPbGwidNpgD:La1a6enOl9Gw5WmD9idNpE

Score
10/10
spynoteandroidbankerdiscoveryevasionpersistence

Malware Config

Extracted

Family

spynote

C2

issues-matthew.gl.at.ply.gg:5009

Targets

    • Target

      febb5529431d6962450cc7a8b6dc0a3bc296f3677b306d77a19b8c82d681dba1.bin

    • Size

      760KB

    • MD5

      508929d723ef460b923050a001f5ef4e

    • SHA1

      e627c2a0b49756201d25d4399f2acae8306e40d9

    • SHA256

      febb5529431d6962450cc7a8b6dc0a3bc296f3677b306d77a19b8c82d681dba1

    • SHA512

      59efdb6af3bc3fa24af109acfe6960b33f1cf531519e1bace6b7f05365f1c8180f7c7de3cbc9503750d715cde88157c3ee3024401316325491aa6ca0763c0f19

    • SSDEEP

      12288:/PBJa1a8Lden13Il9Gw5WmpYshXZPbGwidNpgD:La1a6enOl9Gw5WmD9idNpE

    Score
    8/10
    bankerdiscoveryevasionpersistence

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Registers a broadcast receiver at runtime (usually for listening for system events)

      persistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks