Analysis
-
max time kernel
29s -
max time network
34s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
17-12-2024 00:57
General
-
Target
104c979451404484a8f33e232210490c42330873f023d39abbe05b8af7e7be2e.apk
-
Size
6.6MB
-
MD5
30500ebb730127706c8d013db441b5f4
-
SHA1
63ca81ea7d3ef0777f5a05d352553fd6418e4d50
-
SHA256
104c979451404484a8f33e232210490c42330873f023d39abbe05b8af7e7be2e
-
SHA512
82048105c36d7f2e064f2fcfe71bdb67275d3973da615e088d1821d7c9ff5029dfce6379ee9ff1b9d7c1c33d5c97fc5c839c8c5527d34a09ffd39833ad367323
-
SSDEEP
98304:1bhkTuP50I6wtdWsh3iknKRTnt9Pkuo17qc3GMFWCE3UcNbyt0tIzB0mzCTuf2h:1d1SwHd3iSkjr6xqc3a4zayC
Malware Config
Extracted
spynote
178.255.218.216:7001
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote family
-
Spynote payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
cultures.fundamental.reasonable1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD50d94f106aee7a789401baa4e5d788e33
SHA110e3f7f64acb025a70848e5290f22947578983c1
SHA2560806180563f43c62d943f9a5299d5d8fe44a7a967370ee10d19e5f6fd47b290b
SHA5121683b059edf6de68fd0bc919226a4dfef5adb56d1d2df2a78512522eb6ef359be18399686861e1fd97f22b8d6c5095f6cddd66daad3f6bddd8f1165d4fda2c0b
-
Filesize
3.1MB
MD512b0d1dec6616d7b8b012560cce91159
SHA14965981f841fa6e9f19bb172decf7c566a3a8638
SHA2566e32765c07debbc6df70fcc5a6dcad07d55b84a4840ad8479431872bf98fb514
SHA512a9c96f9ae21d6d53794718bf4aa39670f40fc72c4fae440f4f2836d03ab239dbbbeb12621d5524d5a18c34b20a2c07d9eaa8a00af5d59f5c238f6737b38bab5f
-
Filesize
6.4MB
MD5a965ad2a164ed2ffc15ac73ed2ba1815
SHA14b07f503d8c4ac16a185d09f066d362163b861e5
SHA256500d02947bfbab6becb4f600aadf7db019fc11ad4828235fb36e95366eafdbdf
SHA5129ca00e62c8852dc8c41962d02674bb61205f36be4b5058a1032d1da7857051836f460750b6003d9d0b51ba42986b09e2880db816c98180d4846867b44afad2ed
-
Filesize
21B
MD549a46df8628462b2e85c59b785d3ffd9
SHA1e6ad5cab38022c488903fb1475b4fed021070f46
SHA256189e442c77f2e0be8fd8d21c5cbdf79fb3f430e82acb783fa913e6af2dc0f319
SHA5121fdc0457f4f949a8227cc49a7141b170d5db7539b256ca2e7714b0e0fb1c4139e2c8622110372bd539f492a2da1829a0fb0a508cd86bdda6b1df1d91c9ad1b77
-
Filesize
25B
MD5ba30336bf53d54ed3c0ea69dd545de8c
SHA1ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA2562d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
SHA512eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
-
Filesize
276B
MD55174328cf80598784c73164111bc5487
SHA196422dcd10fc03d7416edabcff440e84aacb8095
SHA256f9682e98ac65037c24f278138ea24aef6d90c55b43c3e7a7d283e3238fc7f001
SHA51264b4a28e5c90c05ac31c9ec424b60739b87ee816e14842a08e1f3e1fb3cf9c5a6eba6ac9ab0fedfa0cd420dd20b19e087d3566a5c3cdce9bfb710d7f61d534d4
-
Filesize
57B
MD53af69119804d1d999d56d230338ffd36
SHA169350826205583c8acc385ee0a6e3fc2673ee2ca
SHA25610994862cb263ab6b1e4428cc24cc9c585458fc67544fe0f5dfea81a5a7a115c
SHA5124a41b19d28f637b397d9dff225621694c44c750a9bd65f3e6ad5d3b9acf0d118910ddf53d4618213f9e14c61e0fb154f33f2747dd3b8d50459990767f42fc8cb