General
-
Target
ceксуальные фоточки.apk
-
Size
4.3MB
-
Sample
241111-vrracasdqf
-
MD5
91eaf17f7c0bd30a940ba59bdce10f0d
-
SHA1
dfeb11ecfeb42f1e6b5e579189d419973e2b3ac6
-
SHA256
0fefe74d649c4a9026762b125c3a9bf9d9b81397f098897bf40e7198b22ad147
-
SHA512
c554a391099c6ba0e22b50a5fd6e7833bfd33888fdec9913772765a1bd7682bd2eb98d114bb1a4d3139379f37c10b72b192e685b486c1ccdcfac5a494e957c76
-
SSDEEP
98304:KQgmulr7nfBWdyVcbfAArBFOf/5SGMvvT4FPG+:0R7fBWdOcbBBFOf/0GMvvS
Malware Config
Targets
-
-
Target
ceксуальные фоточки.apk
-
Size
4.3MB
-
MD5
91eaf17f7c0bd30a940ba59bdce10f0d
-
SHA1
dfeb11ecfeb42f1e6b5e579189d419973e2b3ac6
-
SHA256
0fefe74d649c4a9026762b125c3a9bf9d9b81397f098897bf40e7198b22ad147
-
SHA512
c554a391099c6ba0e22b50a5fd6e7833bfd33888fdec9913772765a1bd7682bd2eb98d114bb1a4d3139379f37c10b72b192e685b486c1ccdcfac5a494e957c76
-
SSDEEP
98304:KQgmulr7nfBWdyVcbfAArBFOf/5SGMvvT4FPG+:0R7fBWdOcbBBFOf/0GMvvS
Score10/10-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote family
-
Spynote payload
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock
-
Legitimate hosting services abused for malware hosting/C2
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests enabling of the accessibility settings.
-
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1