spynote | d021bc1ec9819f8223e21c591acb4ff15c32751fb34ae2bdc4f813d13bf87ee4 | Triage

Sharing

General

Target

d021bc1ec9819f8223e21c591acb4ff15c32751fb34ae2bdc4f813d13bf87ee4.zip
Size

9.4MB
Sample

241106-d891catkc1
MD5

03d74cf6adff84199aadc3c6196f8cd1
SHA1

c3ea92435c99118c354a4898191987b2b04e7577
SHA256

d021bc1ec9819f8223e21c591acb4ff15c32751fb34ae2bdc4f813d13bf87ee4
SHA512

7c39016fadb0c8cc492ea18c42ae92a7a61af2b7b6a4597bca0f3d9f2e9a266bb9ce7f9a2e5163dfeae73c56049da70c1cd8615998e029673f8bd9cfe0c13f8c
SSDEEP

98304:ENo+NRZyyzrnqyQd4RsDO7LAYRHemzZzB9TO0txGeW/j:Eag1zr44iDWLAKH5zZ1cj

Score

10^/10

spynote android collection credential_access evasion execution persistence

Malware Config

Targets

- Target
  
  d021bc1ec9819f8223e21c591acb4ff15c32751fb34ae2bdc4f813d13bf87ee4.zip
- Size
  
  9.4MB
- MD5
  
  03d74cf6adff84199aadc3c6196f8cd1
- SHA1
  
  c3ea92435c99118c354a4898191987b2b04e7577
- SHA256
  
  d021bc1ec9819f8223e21c591acb4ff15c32751fb34ae2bdc4f813d13bf87ee4
- SHA512
  
  7c39016fadb0c8cc492ea18c42ae92a7a61af2b7b6a4597bca0f3d9f2e9a266bb9ce7f9a2e5163dfeae73c56049da70c1cd8615998e029673f8bd9cfe0c13f8c
- SSDEEP
  
  98304:ENo+NRZyyzrnqyQd4RsDO7LAYRHemzZzB9TO0txGeW/j:Eag1zr44iDWLAKH5zZ1cj
Score

7^/10

collection credential_access evasion execution persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Acquires the wake lock
- Legitimate hosting services abused for malware hosting/C2
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Foreground Persistence

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

collectioncredential_accessevasionexecutionpersistence

behavioral2

collectioncredential_accessevasionexecutionpersistence

behavioral3

collectioncredential_accessevasionexecutionpersistence