Overview

overview

10

Static

static

10

readysigned.apk

android-9-x86

7

readysigned.apk

android-10-x64

7

readysigned.apk

android-11-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    readysigned.apk

  • Size

    4.6MB

  • Sample

    241121-k1badazfpe

  • MD5

    fa15edeeda23137934b3f814263713dd

  • SHA1

    524ed99b855fbdbc847caa272f3f8b2fd717255e

  • SHA256

    e2efb6041ee34d0f5c2b1c9b6b82fb7e5fe0b48390d40b4d56116aacf5e2dbe5

  • SHA512

    1ef0d0fcf01c27f4209dd62987cdb68322e8fc4e9ef647d4c3edf1ba2730509fd7d7bf2d1e821c2c9e4c663908aaaa5cf128131bc512f5eba4acfc05f0b9db8c

  • SSDEEP

    98304:nZj85OMEKd1GbK0ZWWNWTL5pCIGtgdXmzYdzBZT10ts1Xik:h85OMEKCblZ3NWnQ+d2zYRKOSk

Score
10/10
spynoteandroidcollectioncredential_accessdiscoveryevasionexecutionimpactpersistence

Malware Config

Targets

    • Target

      readysigned.apk

    • Size

      4.6MB

    • MD5

      fa15edeeda23137934b3f814263713dd

    • SHA1

      524ed99b855fbdbc847caa272f3f8b2fd717255e

    • SHA256

      e2efb6041ee34d0f5c2b1c9b6b82fb7e5fe0b48390d40b4d56116aacf5e2dbe5

    • SHA512

      1ef0d0fcf01c27f4209dd62987cdb68322e8fc4e9ef647d4c3edf1ba2730509fd7d7bf2d1e821c2c9e4c663908aaaa5cf128131bc512f5eba4acfc05f0b9db8c

    • SSDEEP

      98304:nZj85OMEKd1GbK0ZWWNWTL5pCIGtgdXmzYdzBZT10ts1Xik:h85OMEKCblZ3NWnQ+d2zYRKOSk

    Score
    7/10
    collectioncredential_accessdiscoveryevasionexecutionpersistenceimpact

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Queries the mobile country code (MCC)

      discovery
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

1
T1541

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Tasks