Analysis
-
max time kernel
29s -
max time network
33s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
17-12-2024 00:57
General
-
Target
104c979451404484a8f33e232210490c42330873f023d39abbe05b8af7e7be2e.apk
-
Size
6.6MB
-
MD5
30500ebb730127706c8d013db441b5f4
-
SHA1
63ca81ea7d3ef0777f5a05d352553fd6418e4d50
-
SHA256
104c979451404484a8f33e232210490c42330873f023d39abbe05b8af7e7be2e
-
SHA512
82048105c36d7f2e064f2fcfe71bdb67275d3973da615e088d1821d7c9ff5029dfce6379ee9ff1b9d7c1c33d5c97fc5c839c8c5527d34a09ffd39833ad367323
-
SSDEEP
98304:1bhkTuP50I6wtdWsh3iknKRTnt9Pkuo17qc3GMFWCE3UcNbyt0tIzB0mzCTuf2h:1d1SwHd3iSkjr6xqc3a4zayC
Malware Config
Extracted
spynote
178.255.218.216:7001
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote family
-
Spynote payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
cultures.fundamental.reasonable1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/cultures.fundamental.reasonable/app_muffin/sCwaUp.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/cultures.fundamental.reasonable/app_muffin/oat/x86/sCwaUp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD50d94f106aee7a789401baa4e5d788e33
SHA110e3f7f64acb025a70848e5290f22947578983c1
SHA2560806180563f43c62d943f9a5299d5d8fe44a7a967370ee10d19e5f6fd47b290b
SHA5121683b059edf6de68fd0bc919226a4dfef5adb56d1d2df2a78512522eb6ef359be18399686861e1fd97f22b8d6c5095f6cddd66daad3f6bddd8f1165d4fda2c0b
-
Filesize
3.1MB
MD512b0d1dec6616d7b8b012560cce91159
SHA14965981f841fa6e9f19bb172decf7c566a3a8638
SHA2566e32765c07debbc6df70fcc5a6dcad07d55b84a4840ad8479431872bf98fb514
SHA512a9c96f9ae21d6d53794718bf4aa39670f40fc72c4fae440f4f2836d03ab239dbbbeb12621d5524d5a18c34b20a2c07d9eaa8a00af5d59f5c238f6737b38bab5f
-
Filesize
6.4MB
MD5a965ad2a164ed2ffc15ac73ed2ba1815
SHA14b07f503d8c4ac16a185d09f066d362163b861e5
SHA256500d02947bfbab6becb4f600aadf7db019fc11ad4828235fb36e95366eafdbdf
SHA5129ca00e62c8852dc8c41962d02674bb61205f36be4b5058a1032d1da7857051836f460750b6003d9d0b51ba42986b09e2880db816c98180d4846867b44afad2ed
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
276B
MD50d8e15094807a60becd3735c1c5a4ab3
SHA112d4d8ccce2ef7907e139286f800701e6d802a2f
SHA2566a9193ffb70973dcd121e941dca2e31a711b17a7f0c2de15517b11bda580450d
SHA512cd11b70fcd7eead6411755e6485a3bdcedab0e4732fdd5f159c29e038f524d6eb010ee1d47c696d1facfe9c7cb11e3dec037eef9eaa7f4f513a2d8297b0ab76e
-
Filesize
21B
MD5cb0a2e694740c7da2d9ab6aeecd3508f
SHA1c529d4162a859632f0d13b1783f8b47feb288ea6
SHA25648e0f3ca589d86540b804db139a84af3761dafb8daf3ed2955bf87389bf19cbc
SHA5123d488b3cf19f588cd4042ac88a7f5f5014c4f83ca6bddeee1f8c5cd499f2494318ed63196b3ceed880e8f67f6177fcaa2652f37db8fe2818f4cec3eb6ca802e6
-
Filesize
21B
MD549a46df8628462b2e85c59b785d3ffd9
SHA1e6ad5cab38022c488903fb1475b4fed021070f46
SHA256189e442c77f2e0be8fd8d21c5cbdf79fb3f430e82acb783fa913e6af2dc0f319
SHA5121fdc0457f4f949a8227cc49a7141b170d5db7539b256ca2e7714b0e0fb1c4139e2c8622110372bd539f492a2da1829a0fb0a508cd86bdda6b1df1d91c9ad1b77
-
Filesize
29B
MD55681d4f2b0cf8f7d7217799eaa72fd4b
SHA1d48d0d74a993a8447b8b8a737c37d3d7ad1f7cd3
SHA256f2122e0fd2154b84f7cdd436652e9bc22724c1620b5bab477a6b3b6f8d79272f
SHA512aa231f4dd38aef478511b425f89c67b4710c9063ad9b21fd4a8b07085942ea51ca0c5b09a11b07dcef5f9d3e1e709ce58b62dcaa4e55467bb05df43c8d982469