spynote | 95a4931c252cdaee98b1e86535a6efb7bd05f9ed9bc0cc408bbc82d9a78e6b1f | Triage

Sharing

General

Target

03d74cf6adff84199aadc3c6196f8cd1.bin
Size

3.6MB
Sample

241107-bcpnessaqb
MD5

8bd03bcc8b78b8a2f282f091581015d3
SHA1

1257ed47cb27fc9469dd6909632e4c5ccd01abe7
SHA256

95a4931c252cdaee98b1e86535a6efb7bd05f9ed9bc0cc408bbc82d9a78e6b1f
SHA512

48eadf29a91862e329af10072d0d9f81098d11c7b62489064cf5325234d552e4e8bb1dd7c109890320d9eececf79434ea08185e9d85d4c97d6a4720d251ca3f8
SSDEEP

98304:G7pju63v4oPeAokf+LUFDplmr2EeBU+rfbGwph:G7NuS4Wxf+EDpAch

Score

10^/10

spynote android collection credential_access evasion execution persistence

Malware Config

Targets

- Target
  
  d021bc1ec9819f8223e21c591acb4ff15c32751fb34ae2bdc4f813d13bf87ee4.zip
- Size
  
  9.4MB
- MD5
  
  03d74cf6adff84199aadc3c6196f8cd1
- SHA1
  
  c3ea92435c99118c354a4898191987b2b04e7577
- SHA256
  
  d021bc1ec9819f8223e21c591acb4ff15c32751fb34ae2bdc4f813d13bf87ee4
- SHA512
  
  7c39016fadb0c8cc492ea18c42ae92a7a61af2b7b6a4597bca0f3d9f2e9a266bb9ce7f9a2e5163dfeae73c56049da70c1cd8615998e029673f8bd9cfe0c13f8c
- SSDEEP
  
  98304:ENo+NRZyyzrnqyQd4RsDO7LAYRHemzZzB9TO0txGeW/j:Eag1zr44iDWLAKH5zZ1cj
Score

7^/10

collection credential_access evasion execution persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Acquires the wake lock
- Legitimate hosting services abused for malware hosting/C2
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Foreground Persistence

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

collectioncredential_accessevasionexecutionpersistence

behavioral2

collectioncredential_accessevasionexecutionpersistence

behavioral3

collectioncredential_accessevasionexecutionpersistence