General
-
Target
EVOBANCO SEGURIDAD (1).apk
-
Size
8.5MB
-
Sample
241030-llymsssjck
-
MD5
2e55b2ed2550f1f9b466fcbfd19493ca
-
SHA1
e48904196b99af8a4e5b0549017cb936431d615a
-
SHA256
07daf427967321c16102096f757391b98a7bdbe4a4eddbcc6edd358759767595
-
SHA512
675e2ee983d50c4d1b60f6f8fd52219fe59bfc4b0f910be9e585568adeceb0e734ba76c09f8d64dccb31cfe9f432038d12a1b8e5e2d2d561e154a7be9b5a2b0d
-
SSDEEP
98304:QHQp2HwjvXIviYHRo2tOOlmzozBbTU0t18:kQp2HwbXOix1zzQHC
Behavioral task
behavioral1
Sample
EVOBANCO SEGURIDAD (1).apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
EVOBANCO SEGURIDAD (1).apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
EVOBANCO SEGURIDAD (1).apk
Resource
android-x64-arm64-20240624-en
Malware Config
Extracted
spynote
51.68.246.84:7771
Targets
-
-
Target
EVOBANCO SEGURIDAD (1).apk
-
Size
8.5MB
-
MD5
2e55b2ed2550f1f9b466fcbfd19493ca
-
SHA1
e48904196b99af8a4e5b0549017cb936431d615a
-
SHA256
07daf427967321c16102096f757391b98a7bdbe4a4eddbcc6edd358759767595
-
SHA512
675e2ee983d50c4d1b60f6f8fd52219fe59bfc4b0f910be9e585568adeceb0e734ba76c09f8d64dccb31cfe9f432038d12a1b8e5e2d2d561e154a7be9b5a2b0d
-
SSDEEP
98304:QHQp2HwjvXIviYHRo2tOOlmzozBbTU0t18:kQp2HwbXOix1zzQHC
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Requests enabling of the accessibility settings.
-
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1