Overview

overview

10

Static

static

10

ready.apk

android-11-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ready.apk

  • Size

    9.3MB

  • Sample

    240602-wkl8gsaa4z

  • MD5

    cf89624b65db5c43410deb43e87a326d

  • SHA1

    b5ad1aa3c8fdd8d32f548eeeae0d143cc14ae4fb

  • SHA256

    a3402e67891b2abd5c52f89c04c1f50ae5d24fb0dd2dbd65bb8f1df2264b5b57

  • SHA512

    771f62f71a2f286cc07a534ae57cdbc39d1556001ccaf405a90484ff72ea10b831dee0b4404b83c1c9b73eef90ac89145811f04509d34620b6435fa3f9feb01a

  • SSDEEP

    98304:vceTrQDjXEBUYGPI7BWLUP09seZMb4MLKymz6zBOT/0tgNDWJhM:vcYQDQBaPIVP09l8LK9zfwv+

Score
10/10
spynoteandroidbankercollectioncredential_accessdiscoveryevasionexecutionpersistence

Malware Config

Targets

    • Target

      ready.apk

    • Size

      9.3MB

    • MD5

      cf89624b65db5c43410deb43e87a326d

    • SHA1

      b5ad1aa3c8fdd8d32f548eeeae0d143cc14ae4fb

    • SHA256

      a3402e67891b2abd5c52f89c04c1f50ae5d24fb0dd2dbd65bb8f1df2264b5b57

    • SHA512

      771f62f71a2f286cc07a534ae57cdbc39d1556001ccaf405a90484ff72ea10b831dee0b4404b83c1c9b73eef90ac89145811f04509d34620b6435fa3f9feb01a

    • SSDEEP

      98304:vceTrQDjXEBUYGPI7BWLUP09seZMb4MLKymz6zBOT/0tgNDWJhM:vcYQDQBaPIVP09l8LK9zfwv+

    Score
    8/10
    bankercollectioncredential_accessdiscoveryevasionexecutionpersistence

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Acquires the wake lock

    • Schedules tasks to execute at a specified time

      Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

      executionpersistence
    behavioral1

MITRE ATT&CK Matrix

Tasks