spynote | 8d2c41d04ad5943af582978fa56ae89bac45e89f4360eec82ca576ce15a8a966

General

Target

02a9c69abd2b84f237567840cf932015.apk
Size

4.4MB
MD5

02a9c69abd2b84f237567840cf932015
SHA1

02451c70253c3b373aa2261d6824607dbc57292e
SHA256

8d2c41d04ad5943af582978fa56ae89bac45e89f4360eec82ca576ce15a8a966
SHA512

82795610867f3b308377979b2e15fe7bb0002d04a574c863be5b66b8b59e07ab9efd37d3402d1bd8efbeeced42dabbfd2fbc95e863233b791d0a5955d7ee4303
SSDEEP

98304:VIrEl4bxLLfhLIIx9GCAPovTD8DQnOEh0JhFfofNLY6aZvYSHc:arEgx350EiPRDIBfIYSHc

Score

10^/10

spynote banker collection credential_access evasion execution impact infostealer persistence rat trojan

Malware Config

Signatures

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote
Spynote family
spynote

Spynote payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-1.dat	family_spynote

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.Turtle.Jewel/app_app_dex/iqbrpmuvo1.fkz	4543	com.Turtle.Jewel
/data/user/0/com.Turtle.Jewel/app_app_dex/iqbrpmuvo1.fkz	4543	com.Turtle.Jewel

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.Turtle.Jewel

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.Turtle.Jewel

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.Turtle.Jewel

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.Turtle.Jewel

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.Turtle.Jewel

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.Turtle.Jewel

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.Turtle.Jewel

com.Turtle.Jewel
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4543

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

Lateral Movement

Collection

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.Turtle.Jewel/app_app_dex/iqbrpmuvo1.fkz

Filesize
5.2MB

MD5
8b5bfe771e4df1497134d657ecd0df1e

SHA1
872096bbd45fb94305ea850bf7c71c818d87424b

SHA256
f52640e89083cf9237bf146b365c7270bae788178c9d8e1bd59e544e36fcf44c

SHA512
9b5e6658da6dc40a417fbe9ac33ed051fa25e8dc9e90b03aba7703923dc37b9f356773747c755dee84d5b36a88c27a084bc88e7daeea4d6a9930594f21e85474

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-11-21.txt

Filesize
13B

MD5
de2c41a51ee9246eb1708f65b511add0

SHA1
2f442d634c8a18760a232c8829d4b5d74a52f074

SHA256
ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab

SHA512
7cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-11-21.txt

Filesize
25B

MD5
835bacc70a60566ad2a535a3fa797547

SHA1
3cd9fb653ede2e2a3af1f4757e81bd59311d1e99

SHA256
1e81346ba3b559e817727155a232eec28a7bf298ee0bf38b4151991870d038bc

SHA512
fca254d8f1e3ecc03e2e95c43e503f5e40cf207d677d42bdfb1d5e0924dcd05df19c28ea09ed535b4462aad3155544364fb6eaed706195f3cdef0eb4b12b85a9

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-11-21.txt

Filesize
29B

MD5
cc6aacec68524079ff4e1ce753ed5fdc

SHA1
776e256ec907a9076f8105e72366faee03964d50

SHA256
e7c13be2524d2721fa87942e195713dab139f1ff4ba23ea95478f142cfd8f013

SHA512
e97dd60e2549dff160cae88cb805c65d7cf09f68f7a93e2799e7d49cc1fd0ad6f7fdae9c116f98bd50472c7da3858cf6a2ceb7e3fbc176ccef9370b17e26bbaa

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-11-21.txt

Filesize
25B

MD5
bdb821a955117250611e94cd23842584

SHA1
81edcea1b44f94cfc140710c8410d0696b760c67

SHA256
076eb89055ff3d929eb732e1002a0105652e628682a741151388ce1df3b6ec9d

SHA512
e52ffed4ee84acc414c530c239c8876d9e99c1f2b2c7626c0ed7fbe0c59b9cb8f8a5e9e983541bea3dfdb849dd3b9593df054c2482ed8bcda7c70ebd960ca268

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads