Analysis
-
max time kernel
179s -
max time network
190s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
-
submitted
17/06/2024, 09:52
General
-
Target
childapp.apk
-
Size
5.9MB
-
MD5
4ba22114b4b4eabac35d708ceafda99b
-
SHA1
5ba11a42028fcb4a43aea514d5f4247a22a93dbb
-
SHA256
39d2d4af6ca442b175c40c0d608a8265dca4ab53e4859ad24789b23494bc8193
-
SHA512
035a98995ec48a92aad98de6d5e652a03487120e664e2f8932c61b6316532ad439fb4e8f7500fe0edbe508a374ce2d4861baff0dbf1ee69c851666c64f5c5659
-
SSDEEP
98304:9oMU1WRYSale8PkTGBD9xvgbHDHFIzmWAfaCsMul+hlX7/RatQOErR2qdD4SKG2H:mxSale8PfTBgzDq0iFMul6Atid8Xb1O+
Malware Config
Extracted
spynote
kyabhai.duckdns.org:8080
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
editor.disciplines.fail1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD58207981590d82bc36b9dbe639b72e315
SHA12051b80b757df1ae184354eac86659acaf5f479c
SHA25636a6bab79f7ea03e0bf4448abfb073733299859243fe08b12582a2eb2039db1f
SHA51233cf767d56dffec4f2a80f3a142a30302384fb713f805aec98bea7b0783794b8c690ed665af10e22c0d11684fd2cb5937d7a808ab29c3af7819cd97c56382d54
-
Filesize
33B
MD5457bb67ebbcfd6615a72a57bbaba8611
SHA1800c43984ec29c34462d915109edd5202c28b74e
SHA256a7f63da9797585957f923d9226c697d5d3d80c059b3b381baaff04c6c73b8a10
SHA512dd94d35b710137a719ef3ada6f609ef1d05b96e2a32e2c8435809786095db09a049b8aa2e9c40de7af941be67904eecff76b22c4470f57d23a7b3c31970c02ae
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
288B
MD56d97132a1785fde33107885d13157f88
SHA17dd9c3fc1a0af230fb16ddf58a37f699dc33a53f
SHA2568266bb6fc2634e066b850ef1db364cb3ecee81ec3adfcd8dbe6ee5f7a81521cb
SHA5127b92ea31dc7b2141371dca74a48b1a8f5b80b103055085d9e4939c7738cc388119820a2aeb870c93399d30c4763b4f6f0555ff730a5c15ce74bcbdad13444dc1
-
Filesize
57B
MD5bc052a2c34ee49dee28310f3a8b61512
SHA16b8cb8645fbf7627af8057e1b5a6c1f8d98b14a5
SHA2566038df308211dd1c0bea9b67e8b19f413d5bbe9e125c65c0b4dd23f747367d24
SHA512b970abb11c1dea0afe968ac47f9432afbcc182ea5bd6b2d99ede1a8dc8912029975497da9cb3f261dea31c6a5ef1dc906ccfbd3aaa3b812234ea8856181fce5f