Malware Analysis Report

2024-07-28 14:48

Sample ID 240615-safq6syckr
Target Standoff123.apk
SHA256 7af7345e3aaefd36eebd58b9db18b480f61dc50ce15ecdaad9f9895fa266e1a2
Tags
spynote banker discovery evasion persistence impact privilege_escalation
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7af7345e3aaefd36eebd58b9db18b480f61dc50ce15ecdaad9f9895fa266e1a2

Threat Level: Known bad

The file Standoff123.apk was found to be: Known bad.

Malicious Activity Summary

spynote banker discovery evasion persistence impact privilege_escalation

Spynote family

Spynote payload

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Declares broadcast receivers with permission to handle system events

Makes use of the framework's foreground persistence service

Requests enabling of the accessibility settings.

Declares services with permission to bind to the system

Requests dangerous framework permissions

Tries to add a device administrator.

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-15 14:55

Signatures

Spynote family

spynote

Spynote payload

Description Indicator Process Target
N/A N/A N/A N/A

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write and read the user's call log data. android.permission.WRITE_CALL_LOG N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 14:55

Reported

2024-06-15 15:13

Platform

android-x64-20240611.1-en

Max time kernel

1078s

Max time network

898s

Command Line

cmf0.c3b5bm90zq.patch

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

cmf0.c3b5bm90zq.patch

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
GB 216.58.204.72:443 ssl.google-analytics.com tcp
GB 216.58.213.14:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 172.217.169.42:443 semanticlocation-pa.googleapis.com tcp
GB 142.250.178.14:443 tcp
GB 216.58.201.98:443 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.179.227:443 tcp
GB 142.250.179.234:443 semanticlocation-pa.googleapis.com tcp
GB 142.250.179.234:443 semanticlocation-pa.googleapis.com tcp
GB 142.250.179.227:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp

Files

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 062396f32a9e3a728aafecabf29bcc48
SHA1 3044aa24359d91e36165451d004d00af788bea4a
SHA256 1dcc24dbd4fcb26ab23c12a50d2808e1f9d7c7ad4d391e60b9a00cfd6a107828
SHA512 90e3684479024925424dda2b14e504d1c98e8a37b6633f10d9f1de09bc8105baa03730aa3d17c6b0b533335738b4055814e4b05f1873c1be3abe192dca05a48f

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 fc846faefb637fb954b6a5f4a5ef3453
SHA1 4db9a5b93073a31a0536cd4b09cf773e0aebdea9
SHA256 c90ca42a47aa8c400bf63bab15670806709f4745177040b29e5ba84b1ea69323
SHA512 5293e4388ca68db6e4fbaae3a8bb1e449715ed75c1f4c9e6a251d323b0749cf1fb3182029db846662377959fe0d468920d3ceba2716a5d0e7745a257e3b5ffa3

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 95e9e546909cb02abd2d78613ebe5908
SHA1 0708858753725136dbd5962dd4fd1ca2cd993ccd
SHA256 9f22dcf55f506b7ba429f7d6b3a7b87180e6e5dc71451741fd3284691fb6a5f6
SHA512 0fc1758ae11db232a0d4a44f8081e5e8b8c28f01d947a3e55dd678780f40dc8c7068d3d2f7a9a0330d1847ef8ad07999afec32dc1ed29f7aa59fe485c9daa94e

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 2fa539807a709802bf008236b7b106c3
SHA1 016b53136058096f3a8faffcc122e5456c26188f
SHA256 0e3cede34ff629f6dee047f088c1324f6e2ba9bb82b222a0f471e3f590838c5b
SHA512 7e25e0e615ad99c85484b3e9c6a476727ccc91b7fb8fd28194ebf6e3b0c033982a719a3415845a68e8e9085b24de1f05ec8a7d224ccf03f7737d4aaf0e2df115

/storage/emulated/0/AxelBolt.net/config15-06-2024.log

MD5 a596b613a3bdbb2ed3cad88b5dd34036
SHA1 39af31f20cdc1367ffb76bee1d70457ca404261e
SHA256 8fad46ec78bb593a845d9e2e4b6aa46e4f0a57ca7b5655c4f4d2e2968ab5eedf
SHA512 1f13365c3af1ca156fa922217075e67ecdcb8b7a72e9826582bcfd242e7308b52fdea0c7fc53232b3bfccd104f80842c0c6704583deb05074f8549ba8960d0ea

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 14:55

Reported

2024-06-15 14:58

Platform

android-x64-arm64-20240611.1-en

Max time kernel

179s

Max time network

132s

Command Line

cmf0.c3b5bm90zq.patch

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Tries to add a device administrator.

privilege_escalation impact
Description Indicator Process Target
Intent action android.app.action.ADD_DEVICE_ADMIN N/A N/A

Processes

cmf0.c3b5bm90zq.patch

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.179.234:443 tcp
GB 142.250.179.234:443 tcp
GB 142.250.187.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.179.238:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.169.72:443 ssl.google-analytics.com tcp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-15 14:55

Reported

2024-06-15 14:58

Platform

android-33-x64-arm64-20240611.1-en

Max time kernel

179s

Max time network

133s

Command Line

cmf0.c3b5bm90zq.patch

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Tries to add a device administrator.

privilege_escalation impact
Description Indicator Process Target
Intent action android.app.action.ADD_DEVICE_ADMIN N/A N/A

Processes

cmf0.c3b5bm90zq.patch

Network

Country Destination Domain Proto
GB 172.217.169.68:443 udp
GB 172.217.169.68:443 tcp
BE 142.251.168.188:5228 tcp
GB 142.250.179.228:443 tcp
GB 216.58.204.74:443 tcp
N/A 224.0.0.251:5353 udp
GB 142.250.180.10:443 udp
GB 142.250.180.10:443 tcp
GB 216.58.212.227:443 tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 216.58.201.99:443 update.googleapis.com tcp
US 34.104.35.123:80 tcp
US 172.64.41.3:443 udp
GB 142.250.200.3:443 udp
GB 172.217.169.68:443 udp
GB 142.250.179.228:443 udp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-15 14:55

Reported

2024-06-15 14:58

Platform

android-x86-arm-20240611.1-en

Max time kernel

178s

Max time network

140s

Command Line

cmf0.c3b5bm90zq.patch

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Tries to add a device administrator.

privilege_escalation impact
Description Indicator Process Target
Intent action android.app.action.ADD_DEVICE_ADMIN N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

cmf0.c3b5bm90zq.patch

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp

Files

N/A