Overview

overview

10

Static

static

6

47db8b5f79...a5.apk

android-9-x86

10

47db8b5f79...a5.apk

android-10-x64

10

47db8b5f79...a5.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    47db8b5f7980d7ba2c5b22a04f17bc3375dd088f6f4e131f6671753b65f1eba5.bin

  • Size

    4.0MB

  • Sample

    250111-1x5mtatpej

  • MD5

    2b663d5c389033d168a4c2e9ddc5c9c2

  • SHA1

    25b9f76da86ffbfeb809da1b485070db154ce11b

  • SHA256

    47db8b5f7980d7ba2c5b22a04f17bc3375dd088f6f4e131f6671753b65f1eba5

  • SHA512

    c1ee5d406ce098497ca8af8ea7343ed89f0df8ae0ad6c60db2f192ca31c33d736458f53f23a90739770d92ab7f6656a4f1c4f9b425585d15a974d527d8e98497

  • SSDEEP

    98304:I/8QSkVBM3BokvfzVmz9zBwNwUTs0txRT5k:mrSkVBMxT0zA//Hdk

Score
10/10
spynoteandroidbankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      47db8b5f7980d7ba2c5b22a04f17bc3375dd088f6f4e131f6671753b65f1eba5.bin

    • Size

      4.0MB

    • MD5

      2b663d5c389033d168a4c2e9ddc5c9c2

    • SHA1

      25b9f76da86ffbfeb809da1b485070db154ce11b

    • SHA256

      47db8b5f7980d7ba2c5b22a04f17bc3375dd088f6f4e131f6671753b65f1eba5

    • SHA512

      c1ee5d406ce098497ca8af8ea7343ed89f0df8ae0ad6c60db2f192ca31c33d736458f53f23a90739770d92ab7f6656a4f1c4f9b425585d15a974d527d8e98497

    • SSDEEP

      98304:I/8QSkVBM3BokvfzVmz9zBwNwUTs0txRT5k:mrSkVBMxT0zA//Hdk

    Score
    10/10
    spynotebankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistencerattrojan

    • Spynote

      Spynote is a Remote Access Trojan first seen in 2017.

      bankertrojaninfostealerratspynote

    • Spynote family

      spynote

    • Spynote payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Tasks