spynote | 33066bfb04c8edd75de98004eba14762823977de63145db399de57c2166d1406

General

Target
33066bfb04c8edd75de98004eba14762823977de63145db399de57c2166d1406.zip
Size 12.9MB
Sample241106-cyfhbatale
SHA256 33066bfb04c8edd75de98004eba14762823977de63145db399de57c2166d1406
MD5 6302ecdac4d5bc87ba4adb70a9b377cc
SHA1 d1cede3fb707c565b5360da2bfc8ce6d330f96c6
SHA512 12a8a9fd8808022bc3e646412246de19764d79dd282de29fbc54df02ff94d8070ba212f9a92d0cc1f292deba333b51cf31da81b5c69853c47e24723842134883
SSDEEP 196608:0xSLBQc/3zX68vAjC/Pu5z8MBi5nA3wGS+0LPmZ8:0saiD1H2ls5newGwLeZ8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  33066bfb04c8edd75de98004eba14762823977de63145db399de57c2166d1406.zip
- Size 12.9MB
- SHA256 33066bfb04c8edd75de98004eba14762823977de63145db399de57c2166d1406
- MD5 6302ecdac4d5bc87ba4adb70a9b377cc
- SHA1 d1cede3fb707c565b5360da2bfc8ce6d330f96c6
- SHA512 12a8a9fd8808022bc3e646412246de19764d79dd282de29fbc54df02ff94d8070ba212f9a92d0cc1f292deba333b51cf31da81b5c69853c47e24723842134883
- SSDEEP 196608:0xSLBQc/3zX68vAjC/Pu5z8MBi5nA3wGS+0LPmZ8:0saiD1H2ls5newGwLeZ8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2 behavioral3
- Target
  childapp.apk
- Size 9.3MB
- SHA256 a2c4875714b92fdaca68879b3227c937d57867479d9975465bc3a8413966342c
- MD5 b9f9b3f15f1d46b2fcc7603c27fdd162
- SHA1 d07bb872d7f523e113986690302cd49577d4ddf8
- SHA512 7619ac4ce1e727e56b7abad8663de921fa4ad5145d8100dc3099013f0f89c69d6412db8ecbe4d5a1d9566aecf30e9d2f5b8343ad9d5c9266faae5bcbca4c8583
- SSDEEP 98304:0OZqx0VfLBQ/kFx3zX6LInnvAjC/D80uemzvzBaTD0tYaWN:exSLBQc/3zX68vAjC/Pu5z8Mk
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

banker collection credential_access discovery evasion execution persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Legitimate hosting services abused for malware hosting/C2
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
behavioral4 behavioral5 behavioral6