Resubmissions
26-10-2024 12:35
241026-psttzathpc 10General
-
Target
chromesec.apk
-
Size
6.0MB
-
Sample
241026-psttzathpc
-
MD5
63801fb6477e574084e27d67613815a4
-
SHA1
cc73568fd97024689cd68bdd57c6f3e9a5f10c15
-
SHA256
b31404188e071efe50919a8e37a4c65176d14c4da92bc1d302b00c97474c6dd2
-
SHA512
eff9e54f90e4e773ae24c1219858a059aefd5741be3e3d26987f892c24f15e449fbf84b9a27ef81a953fe48248593f5f7328600ef2a5a0bc3af132d068250150
-
SSDEEP
98304:kAl0tNzBRp0mz0TsRt3BsaLxNH/Mdf2lwZocKEZOzBcsLYNtoBOAo5FWL:iPzzwsBsExE2BtckYNto/x
Malware Config
Targets
-
-
Target
chromesec.apk
-
Size
6.0MB
-
MD5
63801fb6477e574084e27d67613815a4
-
SHA1
cc73568fd97024689cd68bdd57c6f3e9a5f10c15
-
SHA256
b31404188e071efe50919a8e37a4c65176d14c4da92bc1d302b00c97474c6dd2
-
SHA512
eff9e54f90e4e773ae24c1219858a059aefd5741be3e3d26987f892c24f15e449fbf84b9a27ef81a953fe48248593f5f7328600ef2a5a0bc3af132d068250150
-
SSDEEP
98304:kAl0tNzBRp0mz0TsRt3BsaLxNH/Mdf2lwZocKEZOzBcsLYNtoBOAo5FWL:iPzzwsBsExE2BtckYNto/x
Score10/10-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote family
-
Spynote payload
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1