spynote | 9a7a3c15b79accc5652170a75cf844f05522597e2d696d99d4e53e0aff246c8b | Triage

Resubmissions

13/01/2025, 09:24 UTC

250113-lc9zgawqf1 10

29/12/2024, 04:24 UTC

241229-e1nykssnav 10

Sharing

General

Target

Wizard.apk
Size

4.4MB
Sample

250113-lc9zgawqf1
MD5

578e77777d3e8a760da0c4fee51c3c61
SHA1

2ff58c40007146854c58f038cb4ef9747dc2ffb4
SHA256

9a7a3c15b79accc5652170a75cf844f05522597e2d696d99d4e53e0aff246c8b
SHA512

3f01f0ba33f279ebd380d29a5cdbe0d865e978ffa112e1b4befb36c1d822fc2a4b0d090cf1f34d547d8104b815e68e2055a83ca3f45f7cdd4b1688c196c5c4b4
SSDEEP

98304:uVi7zBbTImzAj0tIu5BkEicehR2oE7T/f/qkRnt7cB6zH:j3z/Iul9oE7TH/qkRnt706zH

Score

10^/10

spynote android collection credential_access evasion execution persistence

Malware Config

Targets

- Target
  
  Wizard.apk
- Size
  
  4.4MB
- MD5
  
  578e77777d3e8a760da0c4fee51c3c61
- SHA1
  
  2ff58c40007146854c58f038cb4ef9747dc2ffb4
- SHA256
  
  9a7a3c15b79accc5652170a75cf844f05522597e2d696d99d4e53e0aff246c8b
- SHA512
  
  3f01f0ba33f279ebd380d29a5cdbe0d865e978ffa112e1b4befb36c1d822fc2a4b0d090cf1f34d547d8104b815e68e2055a83ca3f45f7cdd4b1688c196c5c4b4
- SSDEEP
  
  98304:uVi7zBbTImzAj0tIu5BkEicehR2oE7T/f/qkRnt7cB6zH:j3z/Iul9oE7TH/qkRnt706zH
Score

7^/10

collection credential_access evasion execution persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Requests enabling of the accessibility settings.
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Foreground Persistence

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

collectioncredential_accessevasionexecutionpersistence