Analysis
-
max time kernel
119s -
max time network
115s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
30-10-2024 22:34
Static task
static1
Behavioral task
behavioral1
Sample
Predator (4).apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
Predator (4).apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
Predator (4).apk
Resource
android-x64-arm64-20240624-en
General
-
Target
Predator (4).apk
-
Size
5.4MB
-
MD5
46352504b375c5b0c31eaaf038442104
-
SHA1
05ae792b90b36e77b2338861350aa0299239cd1a
-
SHA256
4691e2ff1044fb50d0287260f89002ee88d4b6bc202248a6205f78bba94825c9
-
SHA512
deb24d6000bc8e74938a2b636f12bc87e2c8e2c79c907d351d2c07855a4c3b300be925b6d8199f4d66c99cd587051341f3e860aedc899f092e371bc565daf4b5
-
SSDEEP
98304:9aLG78St6MJvmzVT7L0tQzBNDbRZQ/M/AqZX6wNdMKMgQZ/w0rvNfG9Le04WqzeT:9v78HMJ+zV4xG9icqaRMg0iFF3
Malware Config
Extracted
spynote
89.238.177.28:7744
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote family
-
pid Process 5003 backup.scottish.ind -
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/backup.scottish.ind/app_DynamicOptDex/cgpm.json 5003 backup.scottish.ind -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId backup.scottish.ind Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId backup.scottish.ind Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText backup.scottish.ind -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock backup.scottish.ind -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground backup.scottish.ind -
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction backup.scottish.ind android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction backup.scottish.ind android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction backup.scottish.ind android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction backup.scottish.ind android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction backup.scottish.ind android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction backup.scottish.ind android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction backup.scottish.ind android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction backup.scottish.ind -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver backup.scottish.ind -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule backup.scottish.ind
Processes
-
backup.scottish.ind1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:5003
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD590640215204a5be233f335f80ec71531
SHA14b931917218498072845e4267b457948fd6c4f16
SHA256051a832dad69a029c0048e39dfc937367a1ddc8705be4eeffc38cdc182d3879b
SHA5124262e3ee531148abc6290fb87f645a238aa18cad37b0db49766e9df393bb975e1e0ef14e47e899e0a8b2d35a112026a74f994b30e5d88cfbb9aee3d860d1af21
-
Filesize
1.8MB
MD5dbb1e14e089c5410cec58bd8b3bf2eda
SHA150d5dd455a34e8a14b6281b562a057acee2c2169
SHA2569259ed7796edd96084932aa083a51bbb4ebd41aa58369ef3e36960ae56cb07a4
SHA5120e8a4ebdfb4f0520ed7ca1d327c16330e4dda31c07fb9423980ac570d93fba4c58c99adc4923a19fc564d0198f0c421b2aee987107974732e01b996e46aa9195
-
Filesize
4.0MB
MD5791781ff64b653857e5390365329edb1
SHA1a9d5301b5797c3d39455828a24c66309231d0857
SHA256dbe9a6f9939dab0f0e5138fc775c1a0a83c5601d7cd297dff92ee16f817a759b
SHA512bf3330fc42489b21c8f0c725b01fe51e7b2483d91b756a84c4719e9cae22a5f68bbd529c960fb761393e28266b4e1ebab849efa81f7152866886509533fa79c0
-
Filesize
25B
MD5749af3b8d53606c7777359dff271710a
SHA138c222bd446af5f06b689e6d1edb6be053dc1918
SHA256507d4a875476633d215eb27e67af2b56c3b12b3403328781850508da7c17a5af
SHA5121bf956585a5d3c2b246e2f4b05292d28776172257599d71f246404b8124450be8a110b37111f929d1717c8bcb414c99ccb490d98f192b7e6e31dfde7c2bacccc
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
276B
MD51f38239697428f7208668a15e5ae18b1
SHA10376df5efbb87c31db0318cd8cdcaa885b0d5608
SHA25637cf804fba0ff5085240d98c8523051b68147d3265f537e2b1fd58eeca3bfa75
SHA5123d9c2c846c6d1570c5510347d5f538b737f25540fb93d3d87ee1c211bc73789b0ea1c9e6bfbd01da8f4f7dd21e7bb9c7c5373104de87f2e0808f24970b72d007
-
Filesize
57B
MD53af69119804d1d999d56d230338ffd36
SHA169350826205583c8acc385ee0a6e3fc2673ee2ca
SHA25610994862cb263ab6b1e4428cc24cc9c585458fc67544fe0f5dfea81a5a7a115c
SHA5124a41b19d28f637b397d9dff225621694c44c750a9bd65f3e6ad5d3b9acf0d118910ddf53d4618213f9e14c61e0fb154f33f2747dd3b8d50459990767f42fc8cb