Overview

overview

10

Static

static

10

6cae7dd061...a5.apk

android-9-x86

7

6cae7dd061...a5.apk

android-10-x64

1

6cae7dd061...a5.apk

android-11-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    454b9a2948df592c048d4e8028857a06.bin

  • Size

    3.6MB

  • Sample

    240607-bt84dsfb8w

  • MD5

    cb1b505c11ef5783e9973a1222f2fc5f

  • SHA1

    8e1bb8e47abbafffe898ccb598a6d735dbb18532

  • SHA256

    0f1da19641367ff5d90db709e0a2b974472d6fec4f8a1428b3b4ca29fb7f98ec

  • SHA512

    04b5379450493651783080569dde2bd441c61e9fd4112376093deb13d6b3d7e4161aaf421be4888b37e7f2ba0204baf04015dd4edafc0582f377c0078df3dfef

  • SSDEEP

    98304:MvTZBwGKvjkfJ8g3wgP/VvoiQiTqhfQnvEQOlq1J7uj1GgOh:MvHGAx8gggP/VvoiQxqcRlq1JuGgOh

Score
10/10
spynoteandroidcollectioncredential_accessdiscoveryevasionexecutionimpactpersistenceprivilege_escalation

Malware Config

Targets

    • Target

      6cae7dd0618ef01e6443c0e23ce2f01e2bc1e981598bf76c99b9b2e17ae920a5.zip

    • Size

      9.3MB

    • MD5

      454b9a2948df592c048d4e8028857a06

    • SHA1

      f3df143c9283cfaf3d70eac01858232e7ccdca5f

    • SHA256

      6cae7dd0618ef01e6443c0e23ce2f01e2bc1e981598bf76c99b9b2e17ae920a5

    • SHA512

      28490d4738b7c279d0982a89bff65d6ee1b5a6ec3a036e085912e874299d52deb9c76fb082c2310695a23418acf6195e18b3526fed62543aecb65b3126b1384e

    • SSDEEP

      98304:V1KdIxWk07qeUquwSVll34Ij33IsGmzfzBOTZ0t4LAvfKV:7KdI1+3UkkMXsxzw2qV

    Score
    7/10
    collectioncredential_accessdiscoveryevasionexecutionimpactpersistenceprivilege_escalation

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Queries information about active data network

      discovery

    • Queries the mobile country code (MCC)

      discovery

    • Tries to add a device administrator.

      privilege_escalationimpact
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1626

Device Administrator Permissions

1
T1626.001

Defense Evasion

Foreground Persistence

1
T1541

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Account Access Removal

1
T1640

Input Injection

1
T1516

Tasks