Malware Analysis Report

2024-07-28 11:34

Sample ID 240615-r7bcaathrh
Target Standoff123.apk
SHA256 7af7345e3aaefd36eebd58b9db18b480f61dc50ce15ecdaad9f9895fa266e1a2
Tags
banker discovery evasion impact persistence privilege_escalation stealth trojan spynote
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7af7345e3aaefd36eebd58b9db18b480f61dc50ce15ecdaad9f9895fa266e1a2

Threat Level: Known bad

The file Standoff123.apk was found to be: Known bad.

Malicious Activity Summary

banker discovery evasion impact persistence privilege_escalation stealth trojan spynote

Spynote family

Spynote payload

Removes its main activity from the application launcher

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Requests dangerous framework permissions

Makes use of the framework's foreground persistence service

Requests enabling of the accessibility settings.

Tries to add a device administrator.

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-15 14:49

Signatures

Spynote family

spynote

Spynote payload

Description Indicator Process Target
N/A N/A N/A N/A

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write and read the user's call log data. android.permission.WRITE_CALL_LOG N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 14:49

Reported

2024-06-15 14:52

Platform

android-x64-arm64-20240611.1-en

Max time kernel

178s

Max time network

132s

Command Line

cmf0.c3b5bm90zq.patch

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Tries to add a device administrator.

privilege_escalation impact
Description Indicator Process Target
Intent action android.app.action.ADD_DEVICE_ADMIN N/A N/A

Processes

cmf0.c3b5bm90zq.patch

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 172.217.16.234:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp

Files

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 55578797276b3d4f26ac3674751c83e8
SHA1 e8b7d98a205500b7031d775df328a1a62fe4b1cf
SHA256 43be9a2f0eda6d6a3bae945cf9ce8ba1bcba1ab8e2b290f19e503d61ebe743cd
SHA512 a8060675895a8a71c123a89b05ecae7bbb19adaa00938b2f8a7173645ed8866db25314fbd588d7af39251992cb6bada913ccb904fa35e227572ac0737188b959

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 ef04b3dd33ae7b90f26e21d4ff4190b8
SHA1 de63950d1f18ff87b37a2595c8be9a5425ba9da3
SHA256 e986aa9ddb4a1f0f9e47498df4cb450a3bc7bf17eb440ac5d1c73764e970bbd7
SHA512 130789fe6508530f65c7a2ac17a4aa8f1d512aa223c5762a8d9c024c752dd195930328d82e2d96018ee9691584227dd149bbd9a5e329c391555cb44f2839af53

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 8b425d9babd2b503f9c5111e4e5cc9cb
SHA1 e25cbe4387b899a343dc63bb8b8587a87fa0e5f0
SHA256 c2d270c5b6cddeeb04c657a9f80b80343e4e6ea48e614df30209032e3f984b2a
SHA512 70755a3082e3a680f7a66ec9e95dc25894c2c38c9a4808902f001922115bfc2554c1fa27065fc6eb8c61f1c2e8d09466f045aca93c2ebcb74009ea058af2260a

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 b4b954b408367eba9f13f746c2af62ca
SHA1 30d7bcb91367ed880fb6fb4227f8ab96aea672ff
SHA256 6bcc35b0da5130770ec8ffb4b3360d3b4490561133bc1fa3d83267953e4398ce
SHA512 f3aa76f011a3d58f02a561d975e7951689800c445dd4652f8f351e4aa18c82567a2b8d303a2d9b591fb00023b76da6658f8fc3d838c193aedee3bbeb89918421

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 a7d1639e03cae0aeb19148c417a70396
SHA1 1977f728511d27458a7ba9c1632c41d40642aea9
SHA256 ef32a9545a465de587d2c9ea1d0519d9a738b2ff7e32fd076e7d96902ea6a762
SHA512 0e58e8806162580be993c33f0f9bbb8b372a2c8b101a23a3df276601db877b86f9c64227b9495515320b24e47f2ae9b010843be2d18ced61a3ac8988aa4bb621

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-15 14:49

Reported

2024-06-15 14:52

Platform

android-33-x64-arm64-20240611.1-en

Max time kernel

179s

Max time network

133s

Command Line

cmf0.c3b5bm90zq.patch

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Tries to add a device administrator.

privilege_escalation impact
Description Indicator Process Target
Intent action android.app.action.ADD_DEVICE_ADMIN N/A N/A

Processes

cmf0.c3b5bm90zq.patch

Network

Country Destination Domain Proto
GB 172.217.16.228:443 udp
GB 172.217.16.228:443 tcp
GB 172.217.16.228:443 udp
GB 216.58.212.196:443 tcp
N/A 224.0.0.251:5353 udp
GB 142.250.187.202:443 udp
GB 142.250.187.202:443 tcp
US 162.159.61.3:443 tcp
US 162.159.61.3:443 tcp
GB 142.250.178.3:443 tcp
US 162.159.61.3:443 udp
GB 142.250.178.3:443 udp
GB 172.217.16.228:443 udp
GB 142.250.179.228:443 udp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-15 14:49

Reported

2024-06-15 14:52

Platform

android-x86-arm-20240611.1-en

Max time kernel

178s

Max time network

159s

Command Line

cmf0.c3b5bm90zq.patch

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Tries to add a device administrator.

privilege_escalation impact
Description Indicator Process Target
Intent action android.app.action.ADD_DEVICE_ADMIN N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

cmf0.c3b5bm90zq.patch

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
GB 216.58.212.202:443 tcp
GB 216.58.212.202:443 tcp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 14:49

Reported

2024-06-15 14:52

Platform

android-x64-20240611.1-en

Max time kernel

175s

Max time network

158s

Command Line

cmf0.c3b5bm90zq.patch

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

cmf0.c3b5bm90zq.patch

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.8:443 ssl.google-analytics.com tcp
GB 142.250.179.234:443 tcp
GB 142.250.200.46:443 tcp
GB 142.250.179.226:443 tcp
GB 142.250.187.234:443 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.234:443 tcp
GB 216.58.212.234:443 tcp
GB 216.58.204.67:443 tcp
GB 216.58.204.67:443 tcp
US 1.1.1.1:53 g.tenor.com udp
GB 172.217.16.234:443 g.tenor.com tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.187.228:443 www.google.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
GB 142.250.200.46:443 tcp

Files

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 55578797276b3d4f26ac3674751c83e8
SHA1 e8b7d98a205500b7031d775df328a1a62fe4b1cf
SHA256 43be9a2f0eda6d6a3bae945cf9ce8ba1bcba1ab8e2b290f19e503d61ebe743cd
SHA512 a8060675895a8a71c123a89b05ecae7bbb19adaa00938b2f8a7173645ed8866db25314fbd588d7af39251992cb6bada913ccb904fa35e227572ac0737188b959

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 84176c9d6d9c7decb003f6d724e61a5e
SHA1 20c1af97825c4fbe810c46cec784cf73a2178ada
SHA256 ec8c152825f2cb593b856f5f0170d56334d4424fc226032856fc5ed42d2b079d
SHA512 fab70356464b12ac15564c5cf57f2f655527cd250832446ad6ccb1434f5429916799430a0dd8f4b963f678560837301adf42e942800927048adfefa3cccca5f3

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 ef04b3dd33ae7b90f26e21d4ff4190b8
SHA1 de63950d1f18ff87b37a2595c8be9a5425ba9da3
SHA256 e986aa9ddb4a1f0f9e47498df4cb450a3bc7bf17eb440ac5d1c73764e970bbd7
SHA512 130789fe6508530f65c7a2ac17a4aa8f1d512aa223c5762a8d9c024c752dd195930328d82e2d96018ee9691584227dd149bbd9a5e329c391555cb44f2839af53

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 8b425d9babd2b503f9c5111e4e5cc9cb
SHA1 e25cbe4387b899a343dc63bb8b8587a87fa0e5f0
SHA256 c2d270c5b6cddeeb04c657a9f80b80343e4e6ea48e614df30209032e3f984b2a
SHA512 70755a3082e3a680f7a66ec9e95dc25894c2c38c9a4808902f001922115bfc2554c1fa27065fc6eb8c61f1c2e8d09466f045aca93c2ebcb74009ea058af2260a

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 c585cf695dad0467e7bee4248bd145ca
SHA1 0ccd66e28ef25dd3fd5577d1bc4628161377e4b2
SHA256 371fea0c7446b9a6cb4205f8fec05c3378b063f5a7bad8842964ec59512ef46b
SHA512 0565e69a9e83f4e694d10c996fc82ec951d6b2ce32eec41931ab9cd9382a63c4236db146665ee629dfea6f9ccc621b1bc6c3b0308bdf8ce5201d35d6fcd0cf6d