Extracted

• • Target
    Predator...apk
  • Size 5.4MB
  • SHA256 aca693e404b51a44e355fa3b02b0c5a7421cbc477245f33bde1f9645d0d4fc77
  • MD5 9213e81f0c9fc7061e8a560fd776f16d
  • SHA1 7527b1ef111f1ef5a27f94ed7839f18528f9d39d
  • SHA512 4b2f7ff21845e39405f9cb6a614a05c4fa1b8e9f9e8a3fc814190331b275015edcb07cd889e9f3aa33f6e398a363b342cefdcac960fa555d0787fcb6891df900
  • SSDEEP 98304:bDWlU6ZP3mztTM0tYzBN2db+Z9/fp7ymUu8JF3P7ZQ/A/Y+ZZajtjsKMgQZ/Q0rf:bDWikWztf3iruFxr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  spynotebankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistenceratstealthtrojan

  • Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote

  • Spynote family

    spynote

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3