Overview

overview

10

Static

static

10

6cae7dd061...a5.apk

android-9-x86

7

6cae7dd061...a5.apk

android-10-x64

7

6cae7dd061...a5.apk

android-11-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    6cae7dd0618ef01e6443c0e23ce2f01e2bc1e981598bf76c99b9b2e17ae920a5.zip

  • Size

    9.3MB

  • Sample

    240606-bxkvzadg6w

  • MD5

    454b9a2948df592c048d4e8028857a06

  • SHA1

    f3df143c9283cfaf3d70eac01858232e7ccdca5f

  • SHA256

    6cae7dd0618ef01e6443c0e23ce2f01e2bc1e981598bf76c99b9b2e17ae920a5

  • SHA512

    28490d4738b7c279d0982a89bff65d6ee1b5a6ec3a036e085912e874299d52deb9c76fb082c2310695a23418acf6195e18b3526fed62543aecb65b3126b1384e

  • SSDEEP

    98304:V1KdIxWk07qeUquwSVll34Ij33IsGmzfzBOTZ0t4LAvfKV:7KdI1+3UkkMXsxzw2qV

Score
10/10
spynoteandroidcollectioncredential_accessdiscoveryevasionexecutionimpactpersistenceprivilege_escalation

Malware Config

Targets

    • Target

      6cae7dd0618ef01e6443c0e23ce2f01e2bc1e981598bf76c99b9b2e17ae920a5.zip

    • Size

      9.3MB

    • MD5

      454b9a2948df592c048d4e8028857a06

    • SHA1

      f3df143c9283cfaf3d70eac01858232e7ccdca5f

    • SHA256

      6cae7dd0618ef01e6443c0e23ce2f01e2bc1e981598bf76c99b9b2e17ae920a5

    • SHA512

      28490d4738b7c279d0982a89bff65d6ee1b5a6ec3a036e085912e874299d52deb9c76fb082c2310695a23418acf6195e18b3526fed62543aecb65b3126b1384e

    • SSDEEP

      98304:V1KdIxWk07qeUquwSVll34Ij33IsGmzfzBOTZ0t4LAvfKV:7KdI1+3UkkMXsxzw2qV

    Score
    7/10
    collectioncredential_accessdiscoveryevasionexecutionimpactpersistenceprivilege_escalation

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Queries information about active data network

      discovery

    • Queries the mobile country code (MCC)

      discovery

    • Tries to add a device administrator.

      privilege_escalationimpact
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1626

Device Administrator Permissions

1
T1626.001

Defense Evasion

Foreground Persistence

1
T1541

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Account Access Removal

1
T1640

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Tasks