spynote | 0996ed9acb21ea6f0a88c337e5b85bcf64e74f972458a6615078710ae5e7529f | Triage

Sharing

General

Target

PouUniverseSpyWare.apk
Size

24.1MB
Sample

240928-fmnakayaqp
MD5

df9fbe5add0819e5689c905ab5d56153
SHA1

fe7a0401d1221cb29b624e24e04f3f23c65dfd65
SHA256

0996ed9acb21ea6f0a88c337e5b85bcf64e74f972458a6615078710ae5e7529f
SHA512

bb531940a94b6f6e04f218eddd3d3fb985452bf11705072a324dfc3187a0bcba99f5717778b58a2af80df58948cd56fa2eb0f673935a176621687a8d7a28e5d2
SSDEEP

393216:P3On7OgumPypg+m9tak1e7b0x2TmEdlrsavEVyaKgZg:mn7bumP19takIox2S0gavEVyaKL

Score

10^/10

spynote android collection credential_access discovery evasion impact persistence

Malware Config

Targets

- Target
  
  PouUniverseSpyWare.apk
- Size
  
  24.1MB
- MD5
  
  df9fbe5add0819e5689c905ab5d56153
- SHA1
  
  fe7a0401d1221cb29b624e24e04f3f23c65dfd65
- SHA256
  
  0996ed9acb21ea6f0a88c337e5b85bcf64e74f972458a6615078710ae5e7529f
- SHA512
  
  bb531940a94b6f6e04f218eddd3d3fb985452bf11705072a324dfc3187a0bcba99f5717778b58a2af80df58948cd56fa2eb0f673935a176621687a8d7a28e5d2
- SSDEEP
  
  393216:P3On7OgumPypg+m9tak1e7b0x2TmEdlrsavEVyaKgZg:mn7bumP19takIox2S0gavEVyaKL
Score

7^/10

collection credential_access discovery evasion persistence impact
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Input Injection

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Input Capture

GUI Input Capture

Keylogging

Discovery

System Information Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Clipboard Data

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Manipulation

Transmitted Data Manipulation

Input Injection

Tasks

static1

behavioral1

collectioncredential_accessdiscoveryevasionpersistence

behavioral2

collectioncredential_accessdiscoveryevasionimpactpersistence

behavioral3

collectioncredential_accessevasionimpact