Overview

overview

10

Static

static

6

Fideuram.apk

android-9-x86

10

Fideuram.apk

android-10-x64

10

Fideuram.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Fideuram.apk

  • Size

    4.5MB

  • Sample

    241009-r8mrps1hqe

  • MD5

    709811335f643e572e935ef20c69540b

  • SHA1

    4ef06d000ccc9fe664ac84bfa49a24f566bcf3fd

  • SHA256

    27408d492d2040d1cbe85aaf0f80f109b659b40c1a73a06cd76e3dfc02749ef7

  • SHA512

    5407be339bba1bbea556bc6a388feeb7e0a03a606476d8f0715ff26aadf9c730ff6933914b1b7c0114556c8b2ea5972a8917072a8f6358ac1de219bd355641c9

  • SSDEEP

    98304:FfEl0bxLLPhWaqYwaZuTzjhudjwhZVB2q4lIvB7h:REQx3pmTxu5wh92Pla7h

Score
10/10
spynoteandroidbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      Fideuram.apk

    • Size

      4.5MB

    • MD5

      709811335f643e572e935ef20c69540b

    • SHA1

      4ef06d000ccc9fe664ac84bfa49a24f566bcf3fd

    • SHA256

      27408d492d2040d1cbe85aaf0f80f109b659b40c1a73a06cd76e3dfc02749ef7

    • SHA512

      5407be339bba1bbea556bc6a388feeb7e0a03a606476d8f0715ff26aadf9c730ff6933914b1b7c0114556c8b2ea5972a8917072a8f6358ac1de219bd355641c9

    • SSDEEP

      98304:FfEl0bxLLPhWaqYwaZuTzjhudjwhZVB2q4lIvB7h:REQx3pmTxu5wh92Pla7h

    Score
    10/10
    spynotebankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistencerattrojanimpact

    • Spynote

      Spynote is a Remote Access Trojan first seen in 2017.

      bankertrojaninfostealerratspynote

    • Spynote payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Queries information about active data network

      discovery

    • Queries the mobile country code (MCC)

      discovery
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Tasks