spynote | 6c93a4bb6c6c2c1b1e6be17b2d4f8c0238bb5ae9d391655d2fe7656ee839a3b3

General

Target

96292453da7dfce366c3241a09646b43.apk
Size

3.9MB
MD5

96292453da7dfce366c3241a09646b43
SHA1

98bd735d05a385ac7c5d8138610c3cab257f0ccc
SHA256

6c93a4bb6c6c2c1b1e6be17b2d4f8c0238bb5ae9d391655d2fe7656ee839a3b3
SHA512

f9a3093d5e18aebea8def3e8d33b1ab941809cd265750d3d86d74f8d7e4d3e6fb2abb1e4a9ab10571d5e6090c3f60467c9ca75e08db9f9eb3693d02c2c1e5e9a
SSDEEP

98304:AqAwqcCIgKPNIq0LUbXrWuMrX4hCYobxLLQxaZOEl0kCHQO:AZwPNxPyLkhMrXIgx3QDE7CHQO

Score

10^/10

spynote banker collection credential_access discovery evasion execution infostealer persistence rat trojan

Malware Config

Signatures

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_spynote
behavioral1/memory/4213-1.dex	family_spynote

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.Paper.Island/app_app_dex/qcsgaxeia1.yto	4213	com.Paper.Island
/data/user/0/com.Paper.Island/app_app_dex/qcsgaxeia1.yto	4282	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.Paper.Island/app_app_dex/qcsgaxeia1.yto --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.Paper.Island/app_app_dex/oat/x86/qcsgaxeia1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.Paper.Island/app_app_dex/qcsgaxeia1.yto	4213	com.Paper.Island

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.Paper.Island

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.Paper.Island

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.Paper.Island

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.Paper.Island

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.Paper.Island

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.Paper.Island

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.Paper.Island

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.Paper.Island

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.Paper.Island

com.Paper.Island
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4213
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.Paper.Island/app_app_dex/qcsgaxeia1.yto --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.Paper.Island/app_app_dex/oat/x86/qcsgaxeia1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4282

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.Paper.Island/app_app_dex/qcsgaxeia1.yto

Filesize
5.2MB

MD5
5221cc096eff6eaac72225cdc53efff5

SHA1
c72bd407b05b3594ac612fb5c0c7ddc2d5b43ab4

SHA256
4a1b709094e28110b8502321b8f56e695190aec495aef4fdb1440bc18ea09048

SHA512
8a694c1a6be674d781975fa96067e1c3d976444ec4feebc54a2a13d8ecec9ac641118a4f190dabe64f410149740ecd182307ac7d245db980fb5e018d8851a4ab

Download Submit
/data/user/0/com.Paper.Island/app_app_dex/qcsgaxeia1.yto

Filesize
5.2MB

MD5
609b205b1e71a93331ab01189bbb1bba

SHA1
bdf343d6888d5e9a1ab959ded4ec3b6d6f4e0bdd

SHA256
baada4d687f35689d97f85753d8f5b2da5452ca7d7bc922a14cab2cba21f5cbc

SHA512
8cf08d79e4221d173277f1902a6e848fa206920b03f4abce7b0eb0387a141e294a84b87fb9d12dcb4ed1691981fc6cf81796c1f53ef98784d91e2804d2e92a54

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-11.txt

Filesize
65B

MD5
e3e3e6b8bf35b76c2601fa2bd45a2bf0

SHA1
22550d5ac870f152f5cb3bb85221606d24877f36

SHA256
074baf7441cbee548f61a0bc118a51a426aaed93b9192647d5b1a99801a51c41

SHA512
10a5bbc7e90b2b91b6e6ae1b31b75758a1dfe84ed8ccf5a08cdbfe99481103d9e5f28018f8794df59c354e0b367576a8faecde6578ddd3b79d4a55eb3f6f1f19

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-11.txt

Filesize
65B

MD5
314f7d078ecb796a5b748ce5f7cbe4d7

SHA1
1b398115eb3b65eb2f53be7d4e9d5c5514d14adc

SHA256
20866f2cea95ae441820ea796d069f00a07a43cf8290acf05ccd7316a6be47da

SHA512
aa5460654b081aa84e63bf8c64c03d8c263d92c5274912c077f57f7d84168e2898cd8ecc524d06f757408505c85387a256fbcf73415420af50f655737582a80a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-11.txt

Filesize
41B

MD5
0b844e514d63d52af0ccb8f9a7d059d3

SHA1
b202b833af12587fd472ff55a1c15f740e5838ac

SHA256
a568a1207c9dda7cfac6dad50fe9d001a42b471803e7fbdb91b5c1121ee5faec

SHA512
dd9646501f8533fd010c0ec9a13edf0d344297b9993365997186c28f9ccabd04ed9db2589792fcfe249eee05ac480e09101eddc2438e3ec55318e1b8474152b6

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-10-11.txt

Filesize
13B

MD5
de2c41a51ee9246eb1708f65b511add0

SHA1
2f442d634c8a18760a232c8829d4b5d74a52f074

SHA256
ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

SHA512
7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads