Overview

overview

10

Static

static

6

5f82b4aa9a...d6.apk

android-9-x86

10

5f82b4aa9a...d6.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f82b4aa9a0c62cf559d2543b7e2041c542703eabc7d0ed51bfcdadf631c96d6.bin

  • Size

    4.6MB

  • Sample

    250107-15pxbs1mb1

  • MD5

    444b954ed79a16ba3c68b9c2fd832619

  • SHA1

    a6d9cb66e3df96d1d5e00e53c6b513f484169246

  • SHA256

    5f82b4aa9a0c62cf559d2543b7e2041c542703eabc7d0ed51bfcdadf631c96d6

  • SHA512

    e3bef6bc725f3050574b8242473703862c79dbdc27b353acf36bd7288b361a9cadeda8a4cf71e4581c07ae96d48ec1cfe41b6f5c68bdb48be033f07bf2cc57b0

  • SSDEEP

    98304:6/+LUzWRxDJ7XupFEVGAX0tUHXQ6kKSb9Jdj1wjcnLe4kSU1:6/+VDJLYzDVb9Jdj1fLe456

Score
10/10
spynoteandroidbankercollectioncredential_accessevasionexecutioninfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      5f82b4aa9a0c62cf559d2543b7e2041c542703eabc7d0ed51bfcdadf631c96d6.bin

    • Size

      4.6MB

    • MD5

      444b954ed79a16ba3c68b9c2fd832619

    • SHA1

      a6d9cb66e3df96d1d5e00e53c6b513f484169246

    • SHA256

      5f82b4aa9a0c62cf559d2543b7e2041c542703eabc7d0ed51bfcdadf631c96d6

    • SHA512

      e3bef6bc725f3050574b8242473703862c79dbdc27b353acf36bd7288b361a9cadeda8a4cf71e4581c07ae96d48ec1cfe41b6f5c68bdb48be033f07bf2cc57b0

    • SSDEEP

      98304:6/+LUzWRxDJ7XupFEVGAX0tUHXQ6kKSb9Jdj1wjcnLe4kSU1:6/+VDJLYzDVb9Jdj1fLe456

    Score
    10/10
    spynotebankercollectioncredential_accessevasionexecutioninfostealerpersistencerattrojan

    • Spynote

      Spynote is a Remote Access Trojan first seen in 2017.

      bankertrojaninfostealerratspynote

    • Spynote family

      spynote

    • Spynote payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence
    behavioral1behavioral2

MITRE ATT&CK Mobile v15

Tasks