Overview

overview

10

Static

static

6

Predator....apk

android-9-x86

10

Predator....apk

android-10-x64

10

Predator....apk

android-11-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    115s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    30-10-2024 22:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Predator....apk

  • Size

    5.4MB

  • MD5

    310b83646c7f937ff0e8cfbc1133dca3

  • SHA1

    030bda90a9ef495752b173f9250929faa58df05e

  • SHA256

    287ecac9a9ca0aaff9131a1cede12032ac0791d83edc3599017a7eb7801e2405

  • SHA512

    baa6721f56dfd4173b97dac31621da826afcc83d3cd6ccd7da421a5a0fb9b932ce72a575e1d01ad70a82d606faf057905417af543b8ad3788fde3f233000d653

  • SSDEEP

    98304:oCQg83liGOmzlTbL0tgzBVhbKVhW6y+J6tBiMYNWgwZQ/M/AaZPqo918KMgQZ/gy:oCiiGJzl4BVhWD+JIBANWgV

Score
10/10
spynotebankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistencerattrojan

Malware Config

Extracted

Family

spynote

C2

89.238.177.28:7744

Signatures

  • Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote
  • Spynote family
    spynote
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • backup.scottish.ind
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:4984

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/backup.scottish.ind/app_DynamicOptDex/SK.json
    Filesize

    1.8MB

    MD5

    17dde74cc2a0e1ead754ea445f341d78

    SHA1

    457ff08c2a0f36194b3fe59734a128e7b9896ce0

    SHA256

    8fe5359a622e3d9764b7cf9cff1380dbdc76ded9a6836b87d660edc407b08a78

    SHA512

    8c58a3fac9bc836bf8e1679486c54f4bdea7cf7784c8372d67462293188bac274946478bb7a731ae000480277e3bf015067073ee96fc7a77db00f40ca73bb92a

    Download Submit

  • /data/data/backup.scottish.ind/app_DynamicOptDex/SK.json
    Filesize

    1.8MB

    MD5

    519425be0ff9d27440ffa44cd30b8f7b

    SHA1

    7d92090e018986eb7811ffd91bbbbc8704c4f997

    SHA256

    2a7267eeabe33904f3850a08f7ead598c4631077f447beb90b0fe4e4057ba6e3

    SHA512

    31c0b7feb3f7ad39ec3365853aa22116d67817a434c6358dc98f07a780069523c17d5d4f1a723a0b128d5afdc24db9f7bc869a0758aaed7ae2df96851cf1f558

    Download Submit

  • /data/user/0/backup.scottish.ind/app_DynamicOptDex/SK.json
    Filesize

    4.0MB

    MD5

    791781ff64b653857e5390365329edb1

    SHA1

    a9d5301b5797c3d39455828a24c66309231d0857

    SHA256

    dbe9a6f9939dab0f0e5138fc775c1a0a83c5601d7cd297dff92ee16f817a759b

    SHA512

    bf3330fc42489b21c8f0c725b01fe51e7b2483d91b756a84c4719e9cae22a5f68bbd529c960fb761393e28266b4e1ebab849efa81f7152866886509533fa79c0

    Download Submit

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt
    Filesize

    25B

    MD5

    749af3b8d53606c7777359dff271710a

    SHA1

    38c222bd446af5f06b689e6d1edb6be053dc1918

    SHA256

    507d4a875476633d215eb27e67af2b56c3b12b3403328781850508da7c17a5af

    SHA512

    1bf956585a5d3c2b246e2f4b05292d28776172257599d71f246404b8124450be8a110b37111f929d1717c8bcb414c99ccb490d98f192b7e6e31dfde7c2bacccc

    Download Submit

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt
    Filesize

    25B

    MD5

    ba30336bf53d54ed3c0ea69dd545de8c

    SHA1

    ce99c6724c75b93b7448e2d9fac16ca702a5711f

    SHA256

    2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

    SHA512

    eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

    Download Submit

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt
    Filesize

    276B

    MD5

    1f38239697428f7208668a15e5ae18b1

    SHA1

    0376df5efbb87c31db0318cd8cdcaa885b0d5608

    SHA256

    37cf804fba0ff5085240d98c8523051b68147d3265f537e2b1fd58eeca3bfa75

    SHA512

    3d9c2c846c6d1570c5510347d5f538b737f25540fb93d3d87ee1c211bc73789b0ea1c9e6bfbd01da8f4f7dd21e7bb9c7c5373104de87f2e0808f24970b72d007

    Download Submit

  • /storage/emulated/0/Config/sys/apps/log/log-2024-10-30.txt
    Filesize

    57B

    MD5

    3af69119804d1d999d56d230338ffd36

    SHA1

    69350826205583c8acc385ee0a6e3fc2673ee2ca

    SHA256

    10994862cb263ab6b1e4428cc24cc9c585458fc67544fe0f5dfea81a5a7a115c

    SHA512

    4a41b19d28f637b397d9dff225621694c44c750a9bd65f3e6ad5d3b9acf0d118910ddf53d4618213f9e14c61e0fb154f33f2747dd3b8d50459990767f42fc8cb

    Download Submit