spynote | 07346cf8ba8cba881250023326382b88dcf4247cfa64501ccc560667614a7297

Analysis

max time kernel
179s
max time network
187s
platform
android_x64
resource
android-33-x64-arm64-20240611.1-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240611.1-enlocale:en-usos:android-13-x64system
submitted
17/06/2024, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Temp_20Mail.apk
Size 3.0MB
Sample240617-l875rawdph
SHA256 07346cf8ba8cba881250023326382b88dcf4247cfa64501ccc560667614a7297
MD5 0870496d78aa5b59ad57e914c1d5f6b0
SHA1 5b9bfa06d05172f61d1ee19724fcd12cec110353
SHA512 7d6fa2a95a198d9486fe924d1098d6761d6b36df4c76db502c6a6cc7123621449711e394d6a61a2024bf8e85b556c391e58354d02f03bb9d7ab710ebeba81876
SSDEEP 49152:xcueXk4qYTmiO+KyYWWLPke4H0F7ZbS8ULmc/hcRGU3DrZb:eue5NO4YuUzXUac/WRGU3DVb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

spynote banker collection credential_access discovery evasion execution infostealer persistence rat trojan

Malware Config

Extracted

Family

spynote

156.245.20.17:7771

Signatures

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/updates.teens.sa/app_apkprotector_dex/classes-v1.bin	4239	updates.teens.sa

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	updates.teens.sa

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	updates.teens.sa

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	updates.teens.sa

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	updates.teens.sa

updates.teens.sa
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Schedules tasks to execute at a specified time
PID:4239

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

classes-v1.bin

Path /data/user/0/updates.teens.sa/app_apkprotector_dex/classes-v1.bin
Size 4.0MB
SHA256 95cd7ea94c69d01216dfea9a1b5a6122d5c8ed7bf8c1baf7c37d069c5c4ca671
MD5 50c6d6acf87e5fc31279bbcab6e658d2
SHA1 3277812d5668f83f4d0f0da6a271d4b77846779e
SHA512 6817015f04e265f9cb7d2d5982d942d54ea5aaa1a4bb0a53d580ba4749b416608c150e5063e13ed8ae576607053e25c2f6838a0bffe3449782775ffc39676e41
SSDEEP 24576:wxLFFjv0dVPwXAXQXUX+v8MoT/c20fP791VfXvo5Ot5X888AKcSGCQXqks:wxMaK62+v5o6f/Vf/oQQ5Goz
MD5 SHA1 SHA512 SSDEEP

Submit Download

log-2024-06-17.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2024-06-17.txt
Size 25B
SHA256 2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
MD5 ba30336bf53d54ed3c0ea69dd545de8c
SHA1 ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA512 eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
MD5 SHA1 SHA512

Submit Download

log-2024-06-17.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2024-06-17.txt
Size 33B
SHA256 6469be6ec15d0e3806a4f7269575c975cd67cfb4bf72dfbca925639b5f9aed59
MD5 9fd4ac5761024c8a9d1667947c9554bc
SHA1 ca91637b959b955e9d701bbd23dd469ed2b91f1c
SHA512 70442911c6a8751e66b4ba40935d77816ffa41b3c653178a6efe42e1be1eba6b9c91d2dedd009fc707cec2fd01956582aa93ca83f85599cc624cce559b9e3a9d
MD5 SHA1 SHA512

Submit Download

log-2024-06-17.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2024-06-17.txt
Size 57B
SHA256 ee0b80df14d841d339e20693a3e9c6038c5b291142f0ad8ca9f7fba93067834c
MD5 5f0ea816557f7174dbdda00315e60145
SHA1 e7f8b8a1fb0ce1d4e76a91fdcbb3a9a56c053117
SHA512 8cc59d9889d9e454119deba0f0ae5657b276dac27c769e848636f422c0f212424e22ca0814a103d4e0f771e6e637d550cd9d36dcf14dc26fdb05e1b43bd338d0
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads