spynote | 41de347b466f9894aa9fd049ac36c8977196d5e95948e7fea800bb6dee4de35d | Triage

Sharing

General

Target

41de347b466f9894aa9fd049ac36c8977196d5e95948e7fea800bb6dee4de35d.bin
Size

5.0MB
Sample

241103-1xr2qawelq
MD5

a569975abcfe2785ef8ae8576cc37629
SHA1

f94fc636737a77f694603b62330090ef41760ad4
SHA256

41de347b466f9894aa9fd049ac36c8977196d5e95948e7fea800bb6dee4de35d
SHA512

cc8fcc03ce121eedd01892654b1d8f5e9d3521cbf98d48ff03878ae7dc3939777d7c21823ba9af302edb7c7ccea94647072b4a0ba7df86977ad520e88a5ba527
SSDEEP

98304:NTMnOWA0ExqhaqSkls96vwqs9rMCTpFjV6kRR9UCSTuGBOnGWRuX4:ZMnO8HhDHls96Ns9rMspFjJRRzSb0n2o

Score

10^/10

spynote android banker collection credential_access evasion execution impact infostealer persistence rat trojan

Malware Config

Targets

- Target
  
  41de347b466f9894aa9fd049ac36c8977196d5e95948e7fea800bb6dee4de35d.bin
- Size
  
  5.0MB
- MD5
  
  a569975abcfe2785ef8ae8576cc37629
- SHA1
  
  f94fc636737a77f694603b62330090ef41760ad4
- SHA256
  
  41de347b466f9894aa9fd049ac36c8977196d5e95948e7fea800bb6dee4de35d
- SHA512
  
  cc8fcc03ce121eedd01892654b1d8f5e9d3521cbf98d48ff03878ae7dc3939777d7c21823ba9af302edb7c7ccea94647072b4a0ba7df86977ad520e88a5ba527
- SSDEEP
  
  98304:NTMnOWA0ExqhaqSkls96vwqs9rMCTpFjV6kRR9UCSTuGBOnGWRuX4:ZMnO8HhDHls96Ns9rMspFjJRRzSb0n2o
Score

10^/10

spynote banker collection credential_access evasion execution impact infostealer persistence rat trojan
- Spynote
  Spynote is a Remote Access Trojan first seen in 2017.
  banker trojan infostealer rat spynote
- Spynote family
  spynote
- Spynote payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Tasks

static1

behavioral1

spynotebankercollectioncredential_accessevasionexecutionimpactinfostealerpersistencerattrojan

behavioral2

spynotebankercollectioncredential_accessevasionexecutionimpactinfostealerpersistencerattrojan

behavioral3

spynotebankercollectioncredential_accessevasionexecutionimpactinfostealerpersistencerattrojan