Overview

overview

10

Static

static

10

6cae7dd061...a5.apk

android-9-x86

7

6cae7dd061...a5.apk

android-10-x64

7

6cae7dd061...a5.apk

android-11-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    6cae7dd0618ef01e6443c0e23ce2f01e2bc1e981598bf76c99b9b2e17ae920a5.zip
  • Size 9.3MB
  • Sample240606-rfekmafb4v
  • SHA256 6cae7dd0618ef01e6443c0e23ce2f01e2bc1e981598bf76c99b9b2e17ae920a5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
spynoteandroidcollectioncredential_accessdiscoveryevasionexecutionimpactpersistenceprivilege_escalation

Malware Config

Targets

    • Target
      6cae7dd0618ef01e6443c0e23ce2f01e2bc1e981598bf76c99b9b2e17ae920a5.zip
    • Size 9.3MB
    • SHA256 6cae7dd0618ef01e6443c0e23ce2f01e2bc1e981598bf76c99b9b2e17ae920a5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    collectioncredential_accessdiscoveryevasionexecutionimpactpersistenceprivilege_escalation

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Queries information about active data network

      discovery

    • Queries the mobile country code (MCC)

      discovery

    • Tries to add a device administrator.

      privilege_escalationimpact
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1626

Device Administrator Permissions

1
T1626.001

Defense Evasion

Foreground Persistence

1
T1541

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Account Access Removal

1
T1640

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Tasks