Malware Analysis Report

2024-10-16 05:16

Sample ID 240711-nswg5avcqj
Target ready.apk
SHA256 62da8865102bffa0ecd97ef4bd259b72f281af2674c7cc16db366e83f3627ab1
Tags
spynote collection credential_access evasion execution persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

62da8865102bffa0ecd97ef4bd259b72f281af2674c7cc16db366e83f3627ab1

Threat Level: Known bad

The file ready.apk was found to be: Known bad.

Malicious Activity Summary

spynote collection credential_access evasion execution persistence

Spynote family

Makes use of the framework's Accessibility service

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Requests dangerous framework permissions

Acquires the wake lock

Requests disabling of battery optimizations (often used to enable hiding in the background).

Makes use of the framework's foreground persistence service

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-11 11:40

Signatures

Spynote family

spynote

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by VPN services to bind with the system. Allows apps to provision VPN services. android.permission.BIND_VPN_SERVICE N/A N/A
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards). android.permission.BIND_INPUT_METHOD N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-11 11:40

Reported

2024-07-11 11:43

Platform

android-x64-20240624-en

Max time kernel

179s

Max time network

172s

Command Line

celebrities.authorities.powered

Signatures

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Processes

celebrities.authorities.powered

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.213.8:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 instruments-av.gl.at.ply.gg udp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.213.14:443 android.apis.google.com tcp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp
GB 216.58.213.14:443 android.apis.google.com tcp
GB 142.250.178.2:443 tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp

Files

/storage/emulated/0/Config/sys/apps/log/log-2024-07-11.txt

MD5 67bcc37a9b6aa7a023fcdd514f7670e8
SHA1 8545df8b54081ccc21fb117c107226107af02680
SHA256 e174bd88d346084a09a8a7a725a58454c707259aa36beac5bd83f850cf1503c5
SHA512 756aef13b043f8e5fe4c48c948b1aa949fe4e5bf4e833292ae736e1b94eaded3aa0fa08339f8d9246a7cf10a0a78b9b78c871a1fc2eef5c3593a904809bc5b01

/storage/emulated/0/Config/sys/apps/log/log-2024-07-11.txt

MD5 29c860eaf6f36678345f0a9f6b9cc0d9
SHA1 7ffbfbc250be31fd70760cb9f0536e6e4f45c6ef
SHA256 a1ea0cecec3d74e34e9874060753be7786995c8cc62e1daa420f930122f43eec
SHA512 290f920dbee3dd59bd258ec398f0816ee24a620392ce8deaad0e6d1eaa1208f891393522d8125aea4aef9163f9011a02b3463e2d41a4e24bde065fcbad57ed20

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-11 11:40

Reported

2024-07-11 11:43

Platform

android-x64-arm64-20240624-en

Max time kernel

179s

Max time network

187s

Command Line

celebrities.authorities.powered

Signatures

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Processes

celebrities.authorities.powered

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.206:443 tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.213.14:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.200:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 instruments-av.gl.at.ply.gg udp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp

Files

/storage/emulated/0/Config/sys/apps/log/log-2024-07-11.txt

MD5 29c860eaf6f36678345f0a9f6b9cc0d9
SHA1 7ffbfbc250be31fd70760cb9f0536e6e4f45c6ef
SHA256 a1ea0cecec3d74e34e9874060753be7786995c8cc62e1daa420f930122f43eec
SHA512 290f920dbee3dd59bd258ec398f0816ee24a620392ce8deaad0e6d1eaa1208f891393522d8125aea4aef9163f9011a02b3463e2d41a4e24bde065fcbad57ed20

/storage/emulated/0/Config/sys/apps/log/log-2024-07-11.txt

MD5 b9b530e2448252311640bbecb69b796a
SHA1 215ede46fb42a68a7ae84c3019acb3019668a46c
SHA256 5a290151305de1ec4f790cd8ada8bd68c076a2c4ed497c40a519509659b65150
SHA512 5834499307946d130887067b2f837ddfef7fdfe3a7e5ed8977eb14c2dc1ab328334da35ed4c978e20b3e6b28ff30dbd12f0430f4b7c831481f339d360c260919

Analysis: behavioral3

Detonation Overview

Submitted

2024-07-11 11:40

Reported

2024-07-11 11:43

Platform

android-33-x64-arm64-20240624-en

Max time kernel

179s

Max time network

188s

Command Line

celebrities.authorities.powered

Signatures

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Processes

celebrities.authorities.powered

Network

Country Destination Domain Proto
GB 142.250.200.36:443 udp
GB 142.250.200.36:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 instruments-av.gl.at.ply.gg udp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 1.1.1.1:53 rcs-acs-tmo-us.jibe.google.com udp
US 216.239.36.155:443 rcs-acs-tmo-us.jibe.google.com tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 172.217.16.234:443 remoteprovisioning.googleapis.com tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
GB 142.250.178.3:443 tcp
US 172.64.41.3:443 udp
GB 142.250.178.3:443 udp
GB 142.250.200.36:443 udp
GB 216.58.204.68:443 udp
GB 216.58.204.68:443 tcp
GB 216.58.204.68:443 tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp

Files

/storage/emulated/0/Config/sys/apps/log/log-2024-07-11.txt

MD5 29c860eaf6f36678345f0a9f6b9cc0d9
SHA1 7ffbfbc250be31fd70760cb9f0536e6e4f45c6ef
SHA256 a1ea0cecec3d74e34e9874060753be7786995c8cc62e1daa420f930122f43eec
SHA512 290f920dbee3dd59bd258ec398f0816ee24a620392ce8deaad0e6d1eaa1208f891393522d8125aea4aef9163f9011a02b3463e2d41a4e24bde065fcbad57ed20

/storage/emulated/0/Config/sys/apps/log/log-2024-07-11.txt

MD5 b9b530e2448252311640bbecb69b796a
SHA1 215ede46fb42a68a7ae84c3019acb3019668a46c
SHA256 5a290151305de1ec4f790cd8ada8bd68c076a2c4ed497c40a519509659b65150
SHA512 5834499307946d130887067b2f837ddfef7fdfe3a7e5ed8977eb14c2dc1ab328334da35ed4c978e20b3e6b28ff30dbd12f0430f4b7c831481f339d360c260919

Analysis: behavioral4

Detonation Overview

Submitted

2024-07-11 11:40

Reported

2024-07-11 11:43

Platform

android-x86-arm-20240624-en

Max time kernel

179s

Max time network

186s

Command Line

celebrities.authorities.powered

Signatures

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Processes

celebrities.authorities.powered

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.42:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 instruments-av.gl.at.ply.gg udp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.179.238:443 android.apis.google.com tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp
US 147.185.221.20:49528 instruments-av.gl.at.ply.gg tcp

Files

/storage/emulated/0/Config/sys/apps/log/log-2024-07-11.txt

MD5 29c860eaf6f36678345f0a9f6b9cc0d9
SHA1 7ffbfbc250be31fd70760cb9f0536e6e4f45c6ef
SHA256 a1ea0cecec3d74e34e9874060753be7786995c8cc62e1daa420f930122f43eec
SHA512 290f920dbee3dd59bd258ec398f0816ee24a620392ce8deaad0e6d1eaa1208f891393522d8125aea4aef9163f9011a02b3463e2d41a4e24bde065fcbad57ed20

/storage/emulated/0/Config/sys/apps/log/log-2024-07-11.txt

MD5 c9db0aece56267f06c34e62d03659b4a
SHA1 e52a55ea4e5a0d30d70e90a5f5833a39370609d9
SHA256 d77bace5ecc67118face00462acf4fdb6724b5a1647a37b1283e8ca8d316ed80
SHA512 f8f1b07bbfe3837598288ac5935e7ad7e7ccaabbeb90b41903717a62d69a37cbbcc7a9ab63ada7b714f31a333270fd626abf40a27e26fad2a909e12a0d6468b2

/storage/emulated/0/Config/sys/apps/log/log-2024-07-11.txt

MD5 a9ec0c42a43c72d73c499e5c17ccbb8b
SHA1 731652fbfe61eac3fdb4b9d3e2eaa010848a0906
SHA256 6c5309ce3f31c9af3288b0de3305b7f5ddee97be60ca4ac1184f3c334480c05b
SHA512 5f8ed24a51f68cfa0627aceb9190d3a7febaee61bd5a89898ab113ddaa7ce2a41f129a28c4e200d5e5e4ddff7a483abc0393dc38e870782caf1c46d2ec0df2e3

/storage/emulated/0/Config/sys/apps/log/log-2024-07-11.txt

MD5 6b94bea08ec89adfe4d3881d4a0f5219
SHA1 14e92ba374ec92e9955bd8d30ab52a66f9da2e98
SHA256 b860abf383a68809b1da0742522251936f569a317c82052747f83c6ea0cd62c9
SHA512 fa33b75c4e7fadad785fe2db27dcead6ac050ad0500ec651d3deff00cffc800af7ece3e72f93d066538587a7df398f833dde8f964f5273fd6a71f79933e80568

/storage/emulated/0/Config/sys/apps/log/log-2024-07-11.txt

MD5 365f074d64faad2f0f0c7784608e5b57
SHA1 2105b80d01621cbd370bec93f73709a7b67d565b
SHA256 0c4662ed55fc03738e7903864ed0249c921b8f2d858531577eebd53501237cc4
SHA512 d29b5c16d10a78b386ba1f4882f7e80bc6d41887671abe6a36c746b015ea280d4a26f3d2af323b4ad755c256e5851a5b95d0bda8882c6c0a2c125bc748fab47a