spynote | 4e5e37d82b5de82a8a9695a965b4824b8b81db214f9d94fb50769bac9078cdb3 | Triage

Sharing

General

Target

zalupa pupa.apk
Size

5.8MB
Sample

241229-18r6vsylez
MD5

1ec0e6b3088c4e4e1bde66c9ed71c5df
SHA1

4e4c9d50e4d5b6cfdadc39c183f537210ef656fa
SHA256

4e5e37d82b5de82a8a9695a965b4824b8b81db214f9d94fb50769bac9078cdb3
SHA512

7ea15307330802f934915d81d104229203d32dda21badaf4720682ca74d10a46e440e242b6f344cdb8b00b7f99ae6f59cf0d216c1d8c76df081faf4450eef048
SSDEEP

98304:zhsvzBffTtZLmNc93U1Dgh5gGnZDmznaLErZiazBwT0mutJS5:zhozBztZ4ck4g8ZiznaLEr5+

Score

10^/10

spynote android banker collection credential_access discovery evasion execution persistence

Malware Config

Targets

- Target
  
  zalupa pupa.apk
- Size
  
  5.8MB
- MD5
  
  1ec0e6b3088c4e4e1bde66c9ed71c5df
- SHA1
  
  4e4c9d50e4d5b6cfdadc39c183f537210ef656fa
- SHA256
  
  4e5e37d82b5de82a8a9695a965b4824b8b81db214f9d94fb50769bac9078cdb3
- SHA512
  
  7ea15307330802f934915d81d104229203d32dda21badaf4720682ca74d10a46e440e242b6f344cdb8b00b7f99ae6f59cf0d216c1d8c76df081faf4450eef048
- SSDEEP
  
  98304:zhsvzBffTtZLmNc93U1Dgh5gGnZDmznaLErZiazBwT0mutJS5:zhozBztZ4ck4g8ZiznaLEr5+
Score

7^/10

banker collection credential_access discovery evasion execution persistence
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Reads the content of the SMS messages.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

Software Discovery

Security Software Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Protected User Data

SMS Messages

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

bankercollectioncredential_accessdiscoveryevasionexecutionpersistence