Analysis
-
max time kernel
149s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
07-01-2025 22:14
General
-
Target
5f82b4aa9a0c62cf559d2543b7e2041c542703eabc7d0ed51bfcdadf631c96d6.apk
-
Size
4.6MB
-
MD5
444b954ed79a16ba3c68b9c2fd832619
-
SHA1
a6d9cb66e3df96d1d5e00e53c6b513f484169246
-
SHA256
5f82b4aa9a0c62cf559d2543b7e2041c542703eabc7d0ed51bfcdadf631c96d6
-
SHA512
e3bef6bc725f3050574b8242473703862c79dbdc27b353acf36bd7288b361a9cadeda8a4cf71e4581c07ae96d48ec1cfe41b6f5c68bdb48be033f07bf2cc57b0
-
SSDEEP
98304:6/+LUzWRxDJ7XupFEVGAX0tUHXQ6kKSb9Jdj1wjcnLe4kSU1:6/+VDJLYzDVb9Jdj1fLe456
Malware Config
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote family
-
Spynote payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
com.cleaners.kurt1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cleaners.kurt/files/arm/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cleaners.kurt/files/arm/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.1MB
MD5ff1bde91c41cbc21f728591b7f773957
SHA15c2dbffffab6f22ff07537a91f91fc31b3c25107
SHA25636f1936b6e4917b4f59f448bc49840079a8d54f2ff76856db55740aaffc85ca8
SHA5126678f4a444525ca468bb44d2a4e65e84d456c427976c70ee98c9423f4e690b91d71d560c4f4aaa019e58cf1f297af776d70265a4d5e0e30be0f65a53ac354fb9
-
Filesize
5.1MB
MD5e3586c78f7f86f8a3e65cdd08ab2a0cf
SHA109c47e89022b4d9d9aff9b4c75a7e15cf0ee0db7
SHA25627d034ee3acb2cc2e308760d36faed9bb438111442e533c91a7a85c377b2a574
SHA5127633991ca9e160d7f1dc6f96c0760b88e118cd464fd6098bd24b09c5d79017b07aa05c36a09a2787652b38a0d2b60cf9892fb78e20f69325bf22d0b81b1accb8
-
Filesize
25B
MD5bdb821a955117250611e94cd23842584
SHA181edcea1b44f94cfc140710c8410d0696b760c67
SHA256076eb89055ff3d929eb732e1002a0105652e628682a741151388ce1df3b6ec9d
SHA512e52ffed4ee84acc414c530c239c8876d9e99c1f2b2c7626c0ed7fbe0c59b9cb8f8a5e9e983541bea3dfdb849dd3b9593df054c2482ed8bcda7c70ebd960ca268
-
Filesize
13B
MD5de2c41a51ee9246eb1708f65b511add0
SHA12f442d634c8a18760a232c8829d4b5d74a52f074
SHA256ad2d914ca347cd1930e32f21c6d5448c34104bea181b93abc85ec518985653ab
SHA5127cdfbd001594503644e9ed80ae852f90ef9e841a8382e2eec6979e149a2c400a3b83055d205b4d1d66e1600e5127482932d5127eb5800d35a4ee5673fe34d84a
-
Filesize
25B
MD5cf95daed5a7b4c41f6ea32f44ca2a78b
SHA1368c4122a64c09e882edd90715e6194dcaa00955
SHA25636f7f46f6b9a9b9c43d90e8d8722b46c5b8892f1014b5e014198e9a0d6c3d33f
SHA51276d7925c2158ed5c3c223afbf290e524f1c690aab7c0dc3d3252076afefa40ba9a24d3164fa37439381a30e4d8f398771e45eda35138e5fa7ce6bf185cf2408d
-
Filesize
25B
MD55dbb6927ea43dd0fcf29d8795a648cc4
SHA13fcaf87c8844ac0d4cf5beb9c40c40fd899a6380
SHA256e88f6ec7aa82096d262c81e97951eda6ca1302691aa41f638215da960a18d513
SHA512190401b7877367f8bdfc7431d99b9d2ff2a7849778bc8dd1ea0411140a2c7b64d20559df030156e62b7b5f3982761874e96f4f474478ef551996b4799af177f5