Malware Analysis Report

2024-07-28 14:47

Sample ID 240617-l5jmzszejm
Target client.apk
SHA256 84592974fec5ac1c1f28f516700ac0ea5065a602389c44b2015b69e1af6a7579
Tags
banker discovery evasion persistence stealth trojan impact privilege_escalation spynote
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

84592974fec5ac1c1f28f516700ac0ea5065a602389c44b2015b69e1af6a7579

Threat Level: Known bad

The file client.apk was found to be: Known bad.

Malicious Activity Summary

banker discovery evasion persistence stealth trojan impact privilege_escalation spynote

Spynote payload

Spynote family

Removes its main activity from the application launcher

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Declares services with permission to bind to the system

Tries to add a device administrator.

Declares broadcast receivers with permission to handle system events

Requests dangerous framework permissions

Makes use of the framework's foreground persistence service

Requests enabling of the accessibility settings.

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-17 10:06

Signatures

Spynote family

spynote

Spynote payload

Description Indicator Process Target
N/A N/A N/A N/A

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write and read the user's call log data. android.permission.WRITE_CALL_LOG N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 10:06

Reported

2024-06-17 10:13

Platform

android-x64-20240611.1-en

Max time kernel

329s

Max time network

330s

Command Line

cmf0.c3b5bm90zq.patch

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

cmf0.c3b5bm90zq.patch

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.179.234:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.169.40:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.180.10:443 semanticlocation-pa.googleapis.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
GB 216.58.204.78:443 tcp
GB 142.250.200.14:443 tcp
GB 172.217.169.66:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.179.234:443 semanticlocation-pa.googleapis.com tcp
GB 142.250.180.10:443 semanticlocation-pa.googleapis.com tcp
GB 142.250.180.10:443 semanticlocation-pa.googleapis.com tcp
GB 142.250.179.234:443 semanticlocation-pa.googleapis.com tcp

Files

/storage/emulated/0/Internet/config17-06-2024.log

MD5 188375807300ed66f5d9bba886ee784c
SHA1 d162b06b9953391e808488a2f12a32a5d6ad82d1
SHA256 364d5c57e18c169a5777e4049a1ec28107e4e2adad039c9ba13b109fa948e4dc
SHA512 aca99194ebe57b6a57801d394a4b36cc1f2a11786dff3a74fe9a6715f308d484dc6288ecbd693dfd2ecac85c07d7ec101727227375a3d3d5ebcf52a91f079c0b

/storage/emulated/0/Internet/config17-06-2024.log

MD5 10b983399f648b8a73a036d291481b12
SHA1 5ff12264bb2c81f6b9243ec5d484d96a66292f23
SHA256 140e0bd87d4c1c9718eca56d99de55c4ba7ceb952ae0ded9023a39f0173b56e7
SHA512 31769dbd3186146d817d07608b590cf182a5e8fc02c1d71dee6634f76ab84e6b6d5fe2c0ad573fae02a4f119b340dde10250658465cf16501b41ac7a72c0d92a

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 10:06

Reported

2024-06-17 10:14

Platform

android-x64-arm64-20240611.1-en

Max time kernel

329s

Max time network

322s

Command Line

cmf0.c3b5bm90zq.patch

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Tries to add a device administrator.

privilege_escalation impact
Description Indicator Process Target
Intent action android.app.action.ADD_DEVICE_ADMIN N/A N/A

Processes

cmf0.c3b5bm90zq.patch

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.178.4:443 tcp
GB 172.217.169.42:443 tcp
GB 216.58.201.110:443 tcp
BE 108.177.15.188:5228 tcp
US 1.1.1.1:53 www.google.com udp
GB 216.58.212.228:443 www.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.179.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 www.google.com udp
GB 172.217.169.68:443 www.google.com tcp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-17 10:06

Reported

2024-06-17 10:10

Platform

android-33-x64-arm64-20240611.1-en

Max time kernel

134s

Max time network

132s

Command Line

cmf0.c3b5bm90zq.patch

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Tries to add a device administrator.

privilege_escalation impact
Description Indicator Process Target
Intent action android.app.action.ADD_DEVICE_ADMIN N/A N/A

Processes

cmf0.c3b5bm90zq.patch

Network

Country Destination Domain Proto
GB 172.217.169.68:443 udp
GB 172.217.169.68:443 udp
GB 172.217.16.228:443 tcp
N/A 224.0.0.251:5353 udp
GB 216.58.212.234:443 udp
GB 216.58.212.234:443 tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 142.250.187.234:443 remoteprovisioning.googleapis.com tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
GB 172.217.16.227:443 tcp
US 172.64.41.3:443 udp
GB 172.217.16.227:443 udp
GB 172.217.169.68:443 udp
GB 142.250.179.228:443 udp
GB 172.217.169.68:443 tcp
GB 172.217.169.68:443 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
GB 216.58.212.227:443 tcp

Files

/storage/emulated/0/Internet/config17-06-2024.log

MD5 2f9e6d57ba40a4dd819b2770fcffccec
SHA1 f736d680fa82d5b8afbebec49016354b07f537af
SHA256 2b1b0ec96daeebfb1176309d7a791e749ec41628e67efcda1fba3b07c233bf2f
SHA512 1a88805dfbb041a92eb83a920e7496ef6660cf96cb34b311af6f0b5935b664873a2ff1c3f969bfccb899b06deebc6db95ad248396368612f963d56cc4db3d2e4

/storage/emulated/0/Internet/config17-06-2024.log

MD5 bdb552d0eab254f962b59e458bac8caf
SHA1 776cdcd1558a2e72ff91eb8edcdba36c184569cc
SHA256 e0f9f28ad57c625fe327fdf68b3917f052a192f6c12dd9822505c374320c631e
SHA512 56564c853a2eb4908f9922c536168a46f6114d4283e0757b8bdac3b801295e7b3be2fe7e3ab13a1bf7e9debd7f979274c251c81a6cab5b8b121dff6ff3e42f2e

/storage/emulated/0/Internet/config17-06-2024.log

MD5 4c154683405a3d7df0502de492ff08b3
SHA1 f77d3c909dcb973de62486d6f6b034ff866b0650
SHA256 7bb08de4c5d0ca4c510458bda868626394a0370d1047b8ddac4e6f3227b1d498
SHA512 b32f16a49348be7f45a6f8f1ff13fcfa5ee9bc05e549487e988f06258470c293e44efc2cb4812502dfbd7a8de9af9f73f7a997ee11b6a6f06bc3a1cc727a361c

/storage/emulated/0/Internet/config17-06-2024.log

MD5 0c5e4b0172641d5f32d1ad10cafac681
SHA1 8b949928003369a62f08d047226068e14bec2e9f
SHA256 418b2090b6d31c3b06fa3b85de62a8f4e2c4046abbe655c4687ec90dac49642e
SHA512 ccf761e9495e9e34d6b25fc7592baad939e8277131e2805662e36ff477dac38a1da5fc04820cd91a9cf115df225b645700fa04da384b18033e077e8b9a6545dc

/storage/emulated/0/Internet/config17-06-2024.log

MD5 0383058a22d6bf60ba6743cc22b5d836
SHA1 087a70f91f49debc98d224cc7da23f20d1f1348b
SHA256 bdac29c4338239a3c8325d98b7dce0a1bd4c2c871b5c100051e510253be69c1a
SHA512 f3e15d278f7efe4675d3ad4660561a47b8758470635646b3cc61db00f651c0a609c1b4296b5b31683a58ba8d42b418c4c8833c29cfe9f4e487459dd00fe5d113

/storage/emulated/0/Internet/config17-06-2024.log

MD5 e363aa694193b511c582247ce36c6f99
SHA1 f584fc987758223d93f3755d3a4abc754773a954
SHA256 0fc0d062b920c9b04b6b0856eb8ab153dd29de834a9aaa633ceeb89fcc9578d0
SHA512 a099ab379e0631b79447224188e0968286def95740cf077db705089d4b5e641a21916e583d8377d395629cb79dd37741bd72f35ede1c23044d87ceff09ec6c7a