Analysis
-
max time kernel
149s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
07-01-2025 22:14
General
-
Target
5f82b4aa9a0c62cf559d2543b7e2041c542703eabc7d0ed51bfcdadf631c96d6.apk
-
Size
4.6MB
-
MD5
444b954ed79a16ba3c68b9c2fd832619
-
SHA1
a6d9cb66e3df96d1d5e00e53c6b513f484169246
-
SHA256
5f82b4aa9a0c62cf559d2543b7e2041c542703eabc7d0ed51bfcdadf631c96d6
-
SHA512
e3bef6bc725f3050574b8242473703862c79dbdc27b353acf36bd7288b361a9cadeda8a4cf71e4581c07ae96d48ec1cfe41b6f5c68bdb48be033f07bf2cc57b0
-
SSDEEP
98304:6/+LUzWRxDJ7XupFEVGAX0tUHXQ6kKSb9Jdj1wjcnLe4kSU1:6/+VDJLYzDVb9Jdj1fLe456
Malware Config
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote family
-
Spynote payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
com.cleaners.kurt1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.1MB
MD5ff1bde91c41cbc21f728591b7f773957
SHA15c2dbffffab6f22ff07537a91f91fc31b3c25107
SHA25636f1936b6e4917b4f59f448bc49840079a8d54f2ff76856db55740aaffc85ca8
SHA5126678f4a444525ca468bb44d2a4e65e84d456c427976c70ee98c9423f4e690b91d71d560c4f4aaa019e58cf1f297af776d70265a4d5e0e30be0f65a53ac354fb9