spynote | 9142490d12c6dcbf10aab2d93c8e1fe2d34de15393e36bad4556f7e10fa0c4e1 | Triage

Resubmissions

24-01-2025 13:08

250124-qdmmsazlcx 10

24-01-2025 12:45

250124-pzc5sszrar 10

Sharing

General

Target

RATCONNECTOR.apk
Size

5.3MB
Sample

250124-qdmmsazlcx
MD5

a76f0936681fe484462fd7c9d4e72713
SHA1

106c470554eadc3388da5f81025bd54987d301f2
SHA256

9142490d12c6dcbf10aab2d93c8e1fe2d34de15393e36bad4556f7e10fa0c4e1
SHA512

2a8b87c4931f17d96e34d165aa048e465bd167c768dcde4f27f7fa9718339dfbf7652c6d0f56f219de48e1222343a4d61dcb09eb60f15528c82179ae9b68cd42
SSDEEP

98304:dyYFE/PpYf3mnos85GzwmzDzBJTZ0tQaef1Nndef1NnVqWn:xE5Y/mrzP2WNiN3r

Score

10^/10

spynote android banker collection credential_access defense_evasion discovery evasion execution persistence

Malware Config

Targets

- Target
  
  RATCONNECTOR.apk
- Size
  
  5.3MB
- MD5
  
  a76f0936681fe484462fd7c9d4e72713
- SHA1
  
  106c470554eadc3388da5f81025bd54987d301f2
- SHA256
  
  9142490d12c6dcbf10aab2d93c8e1fe2d34de15393e36bad4556f7e10fa0c4e1
- SHA512
  
  2a8b87c4931f17d96e34d165aa048e465bd167c768dcde4f27f7fa9718339dfbf7652c6d0f56f219de48e1222343a4d61dcb09eb60f15528c82179ae9b68cd42
- SSDEEP
  
  98304:dyYFE/PpYf3mnos85GzwmzDzBJTZ0tQaef1Nndef1NnVqWn:xE5Y/mrzP2WNiN3r
Score

7^/10

banker collection credential_access defense_evasion discovery evasion execution persistence
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Requests enabling of the accessibility settings.
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

Software Discovery

Security Software Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

behavioral2

bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistence

behavioral3

bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistence

behavioral4

bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistence