Analysis

  • max time kernel
    119s
  • max time network
    115s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    30-10-2024 22:34

General

  • Target

    Predator (4).apk

  • Size

    5.4MB

  • MD5

    46352504b375c5b0c31eaaf038442104

  • SHA1

    05ae792b90b36e77b2338861350aa0299239cd1a

  • SHA256

    4691e2ff1044fb50d0287260f89002ee88d4b6bc202248a6205f78bba94825c9

  • SHA512

    deb24d6000bc8e74938a2b636f12bc87e2c8e2c79c907d351d2c07855a4c3b300be925b6d8199f4d66c99cd587051341f3e860aedc899f092e371bc565daf4b5

  • SSDEEP

    98304:9aLG78St6MJvmzVT7L0tQzBNDbRZQ/M/AqZX6wNdMKMgQZ/w0rvNfG9Le04WqzeT:9v78HMJ+zV4xG9icqaRMg0iFF3

Malware Config

Extracted

Family

spynote

C2

89.238.177.28:7744

Signatures

  • Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

  • Spynote family
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • backup.scottish.ind
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:5003

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/backup.scottish.ind/app_DynamicOptDex/cgpm.json

    Filesize

    1.8MB

    MD5

    90640215204a5be233f335f80ec71531

    SHA1

    4b931917218498072845e4267b457948fd6c4f16

    SHA256

    051a832dad69a029c0048e39dfc937367a1ddc8705be4eeffc38cdc182d3879b

    SHA512

    4262e3ee531148abc6290fb87f645a238aa18cad37b0db49766e9df393bb975e1e0ef14e47e899e0a8b2d35a112026a74f994b30e5d88cfbb9aee3d860d1af21

  • /data/data/backup.scottish.ind/app_DynamicOptDex/cgpm.json

    Filesize

    1.8MB

    MD5

    dbb1e14e089c5410cec58bd8b3bf2eda

    SHA1

    50d5dd455a34e8a14b6281b562a057acee2c2169

    SHA256

    9259ed7796edd96084932aa083a51bbb4ebd41aa58369ef3e36960ae56cb07a4

    SHA512

    0e8a4ebdfb4f0520ed7ca1d327c16330e4dda31c07fb9423980ac570d93fba4c58c99adc4923a19fc564d0198f0c421b2aee987107974732e01b996e46aa9195

  • /data/user/0/backup.scottish.ind/app_DynamicOptDex/cgpm.json

    Filesize

    4.0MB

    MD5

    791781ff64b653857e5390365329edb1

    SHA1

    a9d5301b5797c3d39455828a24c66309231d0857

    SHA256

    dbe9a6f9939dab0f0e5138fc775c1a0a83c5601d7cd297dff92ee16f817a759b

    SHA512

    bf3330fc42489b21c8f0c725b01fe51e7b2483d91b756a84c4719e9cae22a5f68bbd529c960fb761393e28266b4e1ebab849efa81f7152866886509533fa79c0

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

    Filesize

    25B

    MD5

    749af3b8d53606c7777359dff271710a

    SHA1

    38c222bd446af5f06b689e6d1edb6be053dc1918

    SHA256

    507d4a875476633d215eb27e67af2b56c3b12b3403328781850508da7c17a5af

    SHA512

    1bf956585a5d3c2b246e2f4b05292d28776172257599d71f246404b8124450be8a110b37111f929d1717c8bcb414c99ccb490d98f192b7e6e31dfde7c2bacccc

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

    Filesize

    25B

    MD5

    ba30336bf53d54ed3c0ea69dd545de8c

    SHA1

    ce99c6724c75b93b7448e2d9fac16ca702a5711f

    SHA256

    2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

    SHA512

    eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

    Filesize

    276B

    MD5

    1f38239697428f7208668a15e5ae18b1

    SHA1

    0376df5efbb87c31db0318cd8cdcaa885b0d5608

    SHA256

    37cf804fba0ff5085240d98c8523051b68147d3265f537e2b1fd58eeca3bfa75

    SHA512

    3d9c2c846c6d1570c5510347d5f538b737f25540fb93d3d87ee1c211bc73789b0ea1c9e6bfbd01da8f4f7dd21e7bb9c7c5373104de87f2e0808f24970b72d007

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt

    Filesize

    57B

    MD5

    3af69119804d1d999d56d230338ffd36

    SHA1

    69350826205583c8acc385ee0a6e3fc2673ee2ca

    SHA256

    10994862cb263ab6b1e4428cc24cc9c585458fc67544fe0f5dfea81a5a7a115c

    SHA512

    4a41b19d28f637b397d9dff225621694c44c750a9bd65f3e6ad5d3b9acf0d118910ddf53d4618213f9e14c61e0fb154f33f2747dd3b8d50459990767f42fc8cb