Resubmissions
26-10-2024 12:35
241026-psttzathpc 10Analysis
-
max time kernel
149s -
max time network
155s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
26-10-2024 12:35
General
-
Target
chromesec.apk
-
Size
6.0MB
-
MD5
63801fb6477e574084e27d67613815a4
-
SHA1
cc73568fd97024689cd68bdd57c6f3e9a5f10c15
-
SHA256
b31404188e071efe50919a8e37a4c65176d14c4da92bc1d302b00c97474c6dd2
-
SHA512
eff9e54f90e4e773ae24c1219858a059aefd5741be3e3d26987f892c24f15e449fbf84b9a27ef81a953fe48248593f5f7328600ef2a5a0bc3af132d068250150
-
SSDEEP
98304:kAl0tNzBRp0mz0TsRt3BsaLxNH/Mdf2lwZocKEZOzBcsLYNtoBOAo5FWL:iPzzwsBsExE2BtckYNto/x
Malware Config
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote family
-
Spynote payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
commercial.spice.yr1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/commercial.spice.yr/app_DynamicOptDex/eKnwNYO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/commercial.spice.yr/app_DynamicOptDex/oat/x86/eKnwNYO.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5a1505e4f2ca61a7b924f186a796be47a
SHA1b8f75d4f2fe77b018813f09f06c9bf5fc9f12a16
SHA2569b38804a78e9a18846d5bd79d5255de2b8aad1dd282a5984befdb202d9a62ef3
SHA51254f8b5df396e4bb41e1379d4e93410594be0b8fd3c0548b0c024946eb25719d4af96ef6739091ffec34f764e52611134545ba9f0666148f5900aa173501ddb92
-
Filesize
2.3MB
MD502108f64f4c9accb209dc47db6374cd1
SHA15b33e40b41cda81ac55c901e0a6178a825d81865
SHA25639f18c7afcef63708fa665fe7b39660bcc998913559787d8f3d22b8d1604c893
SHA512e49d442da58a7a03454fb8022056155fd709bfe98ea55ac7559e687ab4b1e68aca4636c2e4f5eabe6ea9aa4f9efd3ebd20dc2b6f3d1f2b3baf915f3a1b0b7562
-
Filesize
5.1MB
MD522892098e96dcee94fb1b21f796b559d
SHA1efdacbc38e59e4904033203e6d9c0a759e4b8598
SHA2564525592a6b33e08c91083951b01a2ec007e53c46bf10038aabd81f4b8931e6a8
SHA5125dbcf02e0bc0cad2bb6c9088c00c02e453db5d3ae6d430b4aee2943c631faefba76bd817b8d7d65962f0fa737e61f457593a6d36a5139f08f47e301a20e625e2
-
Filesize
5.1MB
MD5cedb61cf84da54f27723d3733ed88acb
SHA1cbbf1eced9488f36bd8336a85d3f4e5c1b62876e
SHA25602c17c2d1f45d6d2532263b9377170c30747a1da7c0a475623a0a4e1af76f28f
SHA512cd59d47f952655775750f4fe6fb68e34d5aa83ce2e61c6c041a92d876369f9e4ae0ea5ebdfe4cc0ceaa12e91ac2654023fb8b8f0d4ec99fa72f7d4d00a7be9f6
-
Filesize
25B
MD5bdb821a955117250611e94cd23842584
SHA181edcea1b44f94cfc140710c8410d0696b760c67
SHA256076eb89055ff3d929eb732e1002a0105652e628682a741151388ce1df3b6ec9d
SHA512e52ffed4ee84acc414c530c239c8876d9e99c1f2b2c7626c0ed7fbe0c59b9cb8f8a5e9e983541bea3dfdb849dd3b9593df054c2482ed8bcda7c70ebd960ca268
-
Filesize
13B
MD5de2c41a51ee9246eb1708f65b511add0
SHA12f442d634c8a18760a232c8829d4b5d74a52f074
SHA256ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab
SHA5127cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a
-
Filesize
21B
MD549a46df8628462b2e85c59b785d3ffd9
SHA1e6ad5cab38022c488903fb1475b4fed021070f46
SHA256189e442c77f2e0be8fd8d21c5cbdf79fb3f430e82acb783fa913e6af2dc0f319
SHA5121fdc0457f4f949a8227cc49a7141b170d5db7539b256ca2e7714b0e0fb1c4139e2c8622110372bd539f492a2da1829a0fb0a508cd86bdda6b1df1d91c9ad1b77