Analysis
-
max time kernel
1799s -
max time network
1805s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
17-11-2024 19:31
General
-
Target
BaniizKedra (2).apk
-
Size
5.4MB
-
MD5
6a127ad272931ce3e1030ed1269087ac
-
SHA1
69c36bb20d07217fc90ad0881296be236ce85d2a
-
SHA256
34f9d74a7696be56b453e0af51eaca2188ec938d9e9b7eac94b5457bf4a3ea9a
-
SHA512
d6b2f5e60040522abc4805431fa5634c13dddd86efd76ec342055c2dc819c422b74424624820c285bf462b814ca557c1a0f1a8398d8711f6005edb69aec331a9
-
SSDEEP
98304:fKIKBRU4rZpxd2pOrO2jVuk1M24M4dlMr4ZNHDHUoWRfB:4xl3SOrOlk1L4lM0ZNHDH8B
Malware Config
Extracted
spynote
5.42.92.219:7771
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote family
-
Spynote payload 2 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
discharge.postcard.laughing1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/discharge.postcard.laughing/app_mph_dex/apk.manager-v1.rizal.xml --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/discharge.postcard.laughing/app_mph_dex/oat/x86/apk.manager-v1.rizal.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.1MB
MD50d3537e7d3e8f67095961747753fed34
SHA12abadf6ce7da1c6a30d20cf7201a355b0a677cc6
SHA256afce0f84f7a803bd6ea10e0f9758d5fa31258211f1a3d4c67657603ef65dd40c
SHA512640ddfeba4a2e9ae06ff2516cd5a906c4cb8dc7bda85d3e490f21ba06100fe65e2d0e2c524d413cb936062fa1188ea7de6d6e5422016d1997dade88fa227f48b
-
Filesize
7.1MB
MD5b48b31784323753a3e1f7d1377422a6b
SHA1b40b37de7f84c059ada54a660bf69acc9590d651
SHA256778ad4530ca873da2c5a75a1e4b1928b34675a4b2be48bd95388e5d9b062d758
SHA512fc954c09746da502921b4e9535476f2fd0633ab3170da25b9ad8b7e59b2624137ba54133e0170df2da10d9114a4c42e46028eb79a1e56d45e5b03939985a23d3
-
Filesize
280B
MD5bd0b5205512635a179ae0379719c4058
SHA1d0e8765c62bc380db5440c96c0095cdfa8f04f8c
SHA256afdf1f2a6acdf1fed3c215b7b8ed9d0fa7edebf0aafc4f2e4150baf95e7178f2
SHA512fe7915817ae0d18baedb04762e96d538354874936c72812edf9ed8cfcc36b8e1d77a6658dc98a1ad69f936b75f758f2fcce91320a01859ce78a18aab7954a979
-
Filesize
61B
MD5ada9d3708037b4fdf3b6126f46fc4c87
SHA1f940b3ba053479049f18aa9276a39515af9bbeca
SHA25698b4b5736310ee3c951ebbbf2986516bc0ba923d575f5c657981ef2c26ff772c
SHA5120350786f37af4b0abd59be2deeab1679031e800677eaa2691336bfbd50e05c5000ff3573e82fad28ba924a8bdc18402cf27363ec23a0630c061ee7ad52c1810a
-
Filesize
41B
MD59b34035f49b41c6570eabd93938f6d9a
SHA1431432361dd3deaa06eb8a7031da2b489fbf8f0e
SHA2563eac71cedb99b42276a8c5efbe5f522b2db2f737c24cdafd0b8e233b66cd42cf
SHA5123a73d0aad4d7c07ebe8101042c66827664a39a24eb449c94d7564c12911f0bfd361c374abb20366f458b83969898509726df4c3c9be95f3914b48799957b6d1a
-
Filesize
29B
MD5beeee0c05632c572484e90ff57994a29
SHA11ca5c1dc3b318b56162aa2eb49d43dd4cf2ae841
SHA256a0962c700a11a232386ceac135e0343d6aca311ff0cceb75556e0c45fb8fc527
SHA512caed1d80812a0eb2ec34e117d0424eabb4d2128fa58d5c77dda5fc25458a47cf43719d98a36d1f5007b22bc546a76f1531de4006d0e49807d697b43d0e4fefdc