Overview

overview

10

Static

static

6

31c497e628...3d.apk

android-9-x86

10

31c497e628...3d.apk

android-10-x64

10

31c497e628...3d.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    31c497e628352b99dbe93c25cd16d0191560667700979ca81ee6a118956db13d.bin

  • Size

    4.8MB

  • Sample

    241009-1wzp6svfkq

  • MD5

    4076c6401e4fd111d477e961374577a1

  • SHA1

    a83b06eb149bc9186d64adff68b6dad6777b8b50

  • SHA256

    31c497e628352b99dbe93c25cd16d0191560667700979ca81ee6a118956db13d

  • SHA512

    de1dbfa5b741dfbaf69d8ec1083f34b6f88479521f5ca3bfa453d3b87291dfe235a1f0b1296c2eb03a2bcbd2000b550b8351f920f8c178dbe6674b9f0379f842

  • SSDEEP

    98304:MUIWRcD7OCHonrE19txlRb4i7NOtL7VxLTTJ7ExGrn2IM3TEvFFidRR+UJk7:AD7WICqUtLzLTTGQRgGFidR497

Score
10/10
spynoteandroidbankercollectioncredential_accessevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      31c497e628352b99dbe93c25cd16d0191560667700979ca81ee6a118956db13d.bin

    • Size

      4.8MB

    • MD5

      4076c6401e4fd111d477e961374577a1

    • SHA1

      a83b06eb149bc9186d64adff68b6dad6777b8b50

    • SHA256

      31c497e628352b99dbe93c25cd16d0191560667700979ca81ee6a118956db13d

    • SHA512

      de1dbfa5b741dfbaf69d8ec1083f34b6f88479521f5ca3bfa453d3b87291dfe235a1f0b1296c2eb03a2bcbd2000b550b8351f920f8c178dbe6674b9f0379f842

    • SSDEEP

      98304:MUIWRcD7OCHonrE19txlRb4i7NOtL7VxLTTJ7ExGrn2IM3TEvFFidRR+UJk7:AD7WICqUtLzLTTGQRgGFidR497

    Score
    10/10
    spynotebankercollectioncredential_accessevasionexecutionimpactinfostealerpersistencerattrojan

    • Spynote

      Spynote is a Remote Access Trojan first seen in 2017.

      bankertrojaninfostealerratspynote

    • Spynote payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Tasks