spynote | 31c497e628352b99dbe93c25cd16d0191560667700979ca81ee6a118956db13d

General

Target

31c497e628352b99dbe93c25cd16d0191560667700979ca81ee6a118956db13d.apk
Size

4.8MB
MD5

4076c6401e4fd111d477e961374577a1
SHA1

a83b06eb149bc9186d64adff68b6dad6777b8b50
SHA256

31c497e628352b99dbe93c25cd16d0191560667700979ca81ee6a118956db13d
SHA512

de1dbfa5b741dfbaf69d8ec1083f34b6f88479521f5ca3bfa453d3b87291dfe235a1f0b1296c2eb03a2bcbd2000b550b8351f920f8c178dbe6674b9f0379f842
SSDEEP

98304:MUIWRcD7OCHonrE19txlRb4i7NOtL7VxLTTJ7ExGrn2IM3TEvFFidRR+UJk7:AD7WICqUtLzLTTGQRgGFidR497

Score

10^/10

spynote banker collection credential_access evasion execution impact infostealer persistence rat trojan

Malware Config

Signatures

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_spynote
behavioral1/memory/4260-1.dex	family_spynote

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.lg.myth/app_ded/f3wxYibxcyBoishmu6bIxU9Tc1ylZiER.dex	4260	com.lg.myth
/data/user/0/com.lg.myth/app_ded/f3wxYibxcyBoishmu6bIxU9Tc1ylZiER.dex	4287	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lg.myth/app_ded/f3wxYibxcyBoishmu6bIxU9Tc1ylZiER.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.lg.myth/app_ded/oat/x86/f3wxYibxcyBoishmu6bIxU9Tc1ylZiER.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.lg.myth/app_ded/f3wxYibxcyBoishmu6bIxU9Tc1ylZiER.dex	4260	com.lg.myth

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lg.myth

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lg.myth

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.lg.myth

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.lg.myth

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.lg.myth

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.lg.myth

com.lg.myth
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4260
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lg.myth/app_ded/f3wxYibxcyBoishmu6bIxU9Tc1ylZiER.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.lg.myth/app_ded/oat/x86/f3wxYibxcyBoishmu6bIxU9Tc1ylZiER.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4287
- rm -r/data/user/0/com.lg.myth/app_ded/f3wxYibxcyBoishmu6bIxU9Tc1ylZiER.dex
  2⤵
  PID:4333
- rm -r/data/user/0/com.lg.myth/app_ded/oat/x86/f3wxYibxcyBoishmu6bIxU9Tc1ylZiER.vdex
  2⤵
  PID:4347
- rm -r/data/user/0/com.lg.myth/app_ded/oat/x86/f3wxYibxcyBoishmu6bIxU9Tc1ylZiER.odex
  2⤵
  PID:4366

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.lg.myth/app_ded/f3wxYibxcyBoishmu6bIxU9Tc1ylZiER.dex

Filesize
5.1MB

MD5
4f7da62cb19a877a181de2fea947160a

SHA1
ebc58de222236a185889e23d8d6d32fcacab507e

SHA256
581dd1bd533c79edc54e6ec51ba4f5148dedc96448d05de0e9b9e12cf357b273

SHA512
7cf138defe6d729e010ac290cbf44bfef2abecd6ef9b34efc69c5f774d8b94d0fefc5f48d13c867362c3d4f4c2d5e87cbaa6e1048119880c584635a720add611

Download Submit
/data/user/0/com.lg.myth/app_ded/f3wxYibxcyBoishmu6bIxU9Tc1ylZiER.dex

Filesize
5.1MB

MD5
126a131d1453b7f6245c1af38e5c4983

SHA1
d073c902986f0bd57ad3a18373c70633db93c31f

SHA256
ef9105c5b74b04070db44668c86621a5de3d5da0800a3fa37d68559a0a2a8818

SHA512
c7765173fe85f139a664c802df16ba39d2ef296fe73a65c68791b73eade5dec03f9983d773f385f26cd494452a51ce5ebfa68644a28737d511e11a59f20da946

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-09.txt

Filesize
45B

MD5
d927059b8e7c65972ff16f54b79eebc4

SHA1
5eb4e638fdc0798d5fad10dd1e411b66ed52a9e2

SHA256
007c82af991132865e60601a5f588207deaec257b110195dbd3659360b17b281

SHA512
4be32dcbe6ecf1810f4bf12994ffca16ea690b8fa617fd39ed63d26d84d2b41f17f8979d00f8d51007c941b202532f9d3c29d4d290b55c6b3f5c57451242eaf8

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-09.txt

Filesize
77B

MD5
cb1a91aff28e161cdc8e55ff1627a170

SHA1
85ccc949820a711566a1895c44f668df948dbd9f

SHA256
64e1e377a81d927274ec0cceafc67ac44be1eee5d4a23c20293865e8cdc637a5

SHA512
68cb913605ca8b7a7b0daa2eff9e3fa0f8ab95e1e1959df0aab8fc2e45313e7b48da72e3bf89ec440e099ac9f650dba417d14e9560cd5c911d938cb088eef47e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-09.txt

Filesize
45B

MD5
2a36b046c0f16005018fb4a6cfa1c450

SHA1
687aba9e38c662f5ae95dafcb6b138c6b7687402

SHA256
253a7b22e7aea2cfbef914371c7c8322c444954b0ae8da0e4ac82f3370f19a53

SHA512
f81e807d7609b06a8e4faf61ff2e291266d9f3dc1eca8059fae1b056a372d698c3047ca446ccd12434f2ce480519fe5d474a6fb195336a5e75daa5a0d19442ab

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-09.txt

Filesize
13B

MD5
de2c41a51ee9246eb1708f65b511add0

SHA1
2f442d634c8a18760a232c8829d4b5d74a52f074

SHA256
ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

SHA512
7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads