spynote | a6c65e23a3b5f7562b2542da95343f54a996db03e94af95e28494c091da47378 | Triage

Sharing

General

Target

EvilRAT.apk
Size

4.7MB
Sample

241011-p84zwatbrd
MD5

b05f1858542ec9da030004fbf16f7f3d
SHA1

88833900f5e3c1d3c4e3198378a6d5a2716a65e5
SHA256

a6c65e23a3b5f7562b2542da95343f54a996db03e94af95e28494c091da47378
SHA512

9affb508d6354614439737199afe4843e6e5eb359e3396b1c8c986efdcdea1d4ad6e4a7b201a0bae993c11fef32aa51a74ea066339b9c14b423de88a5914ba84
SSDEEP

98304:t9e+dkOcr1+keftkj19WQ6dgby7zxmzA0zBzTl0tuGG/Yb:t9/d6r8fGjmtgKgzAE6XLb

Score

10^/10

spynote android collection credential_access evasion

Malware Config

Targets

- Target
  
  EvilRAT.apk
- Size
  
  4.7MB
- MD5
  
  b05f1858542ec9da030004fbf16f7f3d
- SHA1
  
  88833900f5e3c1d3c4e3198378a6d5a2716a65e5
- SHA256
  
  a6c65e23a3b5f7562b2542da95343f54a996db03e94af95e28494c091da47378
- SHA512
  
  9affb508d6354614439737199afe4843e6e5eb359e3396b1c8c986efdcdea1d4ad6e4a7b201a0bae993c11fef32aa51a74ea066339b9c14b423de88a5914ba84
- SSDEEP
  
  98304:t9e+dkOcr1+keftkj19WQ6dgby7zxmzA0zBzTl0tuGG/Yb:t9/d6r8fGjmtgKgzAE6XLb
Score

7^/10

collection credential_access evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Acquires the wake lock
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

collectioncredential_accessevasion