Overview

overview

10

Static

static

6

02a9c69abd...15.apk

android-9-x86

10

02a9c69abd...15.apk

android-10-x64

10

02a9c69abd...15.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02a9c69abd2b84f237567840cf932015.apk

  • Size

    4.4MB

  • Sample

    241121-rk9lkaspcw

  • MD5

    02a9c69abd2b84f237567840cf932015

  • SHA1

    02451c70253c3b373aa2261d6824607dbc57292e

  • SHA256

    8d2c41d04ad5943af582978fa56ae89bac45e89f4360eec82ca576ce15a8a966

  • SHA512

    82795610867f3b308377979b2e15fe7bb0002d04a574c863be5b66b8b59e07ab9efd37d3402d1bd8efbeeced42dabbfd2fbc95e863233b791d0a5955d7ee4303

  • SSDEEP

    98304:VIrEl4bxLLfhLIIx9GCAPovTD8DQnOEh0JhFfofNLY6aZvYSHc:arEgx350EiPRDIBfIYSHc

Score
10/10
spynoteandroidbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      02a9c69abd2b84f237567840cf932015.apk

    • Size

      4.4MB

    • MD5

      02a9c69abd2b84f237567840cf932015

    • SHA1

      02451c70253c3b373aa2261d6824607dbc57292e

    • SHA256

      8d2c41d04ad5943af582978fa56ae89bac45e89f4360eec82ca576ce15a8a966

    • SHA512

      82795610867f3b308377979b2e15fe7bb0002d04a574c863be5b66b8b59e07ab9efd37d3402d1bd8efbeeced42dabbfd2fbc95e863233b791d0a5955d7ee4303

    • SSDEEP

      98304:VIrEl4bxLLfhLIIx9GCAPovTD8DQnOEh0JhFfofNLY6aZvYSHc:arEgx350EiPRDIBfIYSHc

    Score
    10/10
    spynotebankerdiscoveryevasionexecutioninfostealerpersistencerattrojancollectioncredential_accessimpact

    • Spynote

      Spynote is a Remote Access Trojan first seen in 2017.

      bankertrojaninfostealerratspynote

    • Spynote family

      spynote

    • Spynote payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Queries the mobile country code (MCC)

      discovery
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Tasks