spynote | ea7b0feda556abd530a52fee4efef53ebcc0cb5beec358bf4d8a3ecd3d002036

Analysis

max time kernel
77s
max time network
682s
platform
android_x64
resource
android-33-x64-arm64-20240624-es
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-eslocale:es-esos:android-13-x64system
submitted
03-12-2024 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96c00e172d4052285950f64a329efb32365fc3e93b5535a84ddfcc715aff5618.apk
Size

5.3MB
MD5

39bdbdf74aa19384e2188763162096b0
SHA1

baffba739efa0f36b820445a20dfaccc9e3ac4f9
SHA256

96c00e172d4052285950f64a329efb32365fc3e93b5535a84ddfcc715aff5618
SHA512

9170a7f2aa4b57e1d0795c7e8caacb34e03fb08817c6f8e0ca547f2dc93991ccc94bb07f68c28bf63a33d10ae9bbc50776fece66b646edf1ce3538254f99c49c
SSDEEP

98304:/LI2MRcJI0G58SuyXdYaTHf/Yuezen31F2GcXKfZOyXCf8PdvQ:/LqRw/G2stHTHf/ezqz2GcXHyXWAQ

Score

10^/10

spynote banker infostealer rat trojan

Malware Config

Extracted

Family

spynote

1.tcp.ngrok.io:26423

Signatures

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote
Spynote family
spynote

Spynote payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_spynote

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
63	1.tcp.ngrok.io
140	1.tcp.ngrok.io
163	1.tcp.ngrok.io
40	1.tcp.ngrok.io
135	1.tcp.ngrok.io
146	1.tcp.ngrok.io
153	1.tcp.ngrok.io
171	1.tcp.ngrok.io
83	1.tcp.ngrok.io

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.appd.instll.load

com.appd.instll.load
1⤵
- Requests enabling of the accessibility settings.
PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.appd.instll.load/files/app.apk.apk

Filesize
5.5MB

MD5
a0d8a46bf254f3ab5475df954e051c4a

SHA1
e462168dad636e41a672c8796b1bc2dae7ed3ef0

SHA256
a4e6b5da2e3ff0aeba40b078e64e3062915cbbd243830078b1af5c419f9df3b9

SHA512
eff19dd00daaeb28cc94c023fcba6edf5691be6a6485efc9b113bf89918eb4d117bea9277eaaa5f61dadb3bf25bd58fe13be121e30967ac3b9c93300feed1d69

Download Submit