Analysis
-
max time kernel
9s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
21-11-2024 14:16
General
-
Target
02a9c69abd2b84f237567840cf932015.apk
-
Size
4.4MB
-
MD5
02a9c69abd2b84f237567840cf932015
-
SHA1
02451c70253c3b373aa2261d6824607dbc57292e
-
SHA256
8d2c41d04ad5943af582978fa56ae89bac45e89f4360eec82ca576ce15a8a966
-
SHA512
82795610867f3b308377979b2e15fe7bb0002d04a574c863be5b66b8b59e07ab9efd37d3402d1bd8efbeeced42dabbfd2fbc95e863233b791d0a5955d7ee4303
-
SSDEEP
98304:VIrEl4bxLLfhLIIx9GCAPovTD8DQnOEh0JhFfofNLY6aZvYSHc:arEgx350EiPRDIBfIYSHc
Malware Config
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote family
-
Spynote payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.Turtle.Jewel1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.Turtle.Jewel/app_app_dex/iqbrpmuvo1.fkz --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.Turtle.Jewel/app_app_dex/oat/x86/iqbrpmuvo1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58b5bfe771e4df1497134d657ecd0df1e
SHA1872096bbd45fb94305ea850bf7c71c818d87424b
SHA256f52640e89083cf9237bf146b365c7270bae788178c9d8e1bd59e544e36fcf44c
SHA5129b5e6658da6dc40a417fbe9ac33ed051fa25e8dc9e90b03aba7703923dc37b9f356773747c755dee84d5b36a88c27a084bc88e7daeea4d6a9930594f21e85474
-
Filesize
5.2MB
MD5e0f5b0f040275d4f3b1d5a6a4af81a37
SHA1bf63463aa3d3a7b543c946229072ed96bb11b365
SHA2566e5948a9a439489ea1c611cfef0dd531cec37f2a7208918a7d905b8ab1656d6a
SHA512fa3a52a970d15dd9f1de6c9ceab0bf42b889e94434883728999397dc37415bff332dbe7663250b0beafc4e487cfa6f0779b545232a1821329c84b4fbf0e49b8e