spynote | 64e7baf7ba8d9f5c359dc638452c52592879536f5dd2f27116300f7b76525c89 | Triage

Sharing

General

Target

ready.apk
Size

9.3MB
Sample

241111-26n7vsygnb
MD5

209edc0e067f6d608dfcb055cf56974c
SHA1

98beb5c40df1bbc6546b0f99f535ef42ab57c6da
SHA256

64e7baf7ba8d9f5c359dc638452c52592879536f5dd2f27116300f7b76525c89
SHA512

9abe45e43bec90bb6b685792f0a855062cf6d2ca37f23f12c04c65bba870b7b830f003a64ed871361adce5a5b585379b38ff4828b9fa529465709a1a16938eb5
SSDEEP

98304:/55gA6W2ygDEnRUJ88CUnFO3eMq5pmz5zBTTB0thay9W:RiW2yKEnmSSFKejczjeK

Score

10^/10

spynote android collection credential_access evasion execution impact persistence privilege_escalation

Malware Config

Targets

- Target
  
  ready.apk
- Size
  
  9.3MB
- MD5
  
  209edc0e067f6d608dfcb055cf56974c
- SHA1
  
  98beb5c40df1bbc6546b0f99f535ef42ab57c6da
- SHA256
  
  64e7baf7ba8d9f5c359dc638452c52592879536f5dd2f27116300f7b76525c89
- SHA512
  
  9abe45e43bec90bb6b685792f0a855062cf6d2ca37f23f12c04c65bba870b7b830f003a64ed871361adce5a5b585379b38ff4828b9fa529465709a1a16938eb5
- SSDEEP
  
  98304:/55gA6W2ygDEnRUJ88CUnFO3eMq5pmz5zBTTB0thay9W:RiW2yKEnmSSFKejczjeK
Score

7^/10

collection credential_access evasion execution impact persistence privilege_escalation
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Tries to add a device administrator.
  privilege_escalation impact
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

Device Administrator Permissions

Defense Evasion

Foreground Persistence

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Account Access Removal

Input Injection

Tasks

static1

behavioral1

collectioncredential_accessevasionexecutionimpactpersistenceprivilege_escalation

behavioral2

collectioncredential_accessevasionexecutionpersistence

behavioral3

collectioncredential_accessevasionexecutionimpactpersistenceprivilege_escalation