spynote | 15ca01130c41b2833468c16616555b26cd4d352cfd52fda81e0391a4fb091744 | Triage

Sharing

General

Target

15ca01130c41b2833468c16616555b26cd4d352cfd52fda81e0391a4fb091744.apk
Size

3.0MB
Sample

250208-wqfmwsxmcs
MD5

ed06bd98a274306ac860e46e1f4d5a5d
SHA1

e249c4416a5cdc347e3d865aaed6f50bb13f1543
SHA256

15ca01130c41b2833468c16616555b26cd4d352cfd52fda81e0391a4fb091744
SHA512

d34d5913744cfa5a6a5f1266f9606da22b285b5598c6541430a8fe759445035b5b3f5430431c27ad9137ec4c20c21b21e76b2774491a127c210a50541465cbd1
SSDEEP

49152:z461uYnTCeY3qF5oLv+EmmzbzdGG+QTOOxUcYqK0cgcImaQJygmRIy:z41EzzVEmmzbzBRTY0tc9aNIy

Score

10^/10

spynote android collection credential_access defense_evasion execution persistence

Malware Config

Targets

- Target
  
  15ca01130c41b2833468c16616555b26cd4d352cfd52fda81e0391a4fb091744.apk
- Size
  
  3.0MB
- MD5
  
  ed06bd98a274306ac860e46e1f4d5a5d
- SHA1
  
  e249c4416a5cdc347e3d865aaed6f50bb13f1543
- SHA256
  
  15ca01130c41b2833468c16616555b26cd4d352cfd52fda81e0391a4fb091744
- SHA512
  
  d34d5913744cfa5a6a5f1266f9606da22b285b5598c6541430a8fe759445035b5b3f5430431c27ad9137ec4c20c21b21e76b2774491a127c210a50541465cbd1
- SSDEEP
  
  49152:z461uYnTCeY3qF5oLv+EmmzbzdGG+QTOOxUcYqK0cgcImaQJygmRIy:z41EzzVEmmzbzBRTY0tc9aNIy
Score

7^/10

collection credential_access defense_evasion execution persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Foreground Persistence

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

collectioncredential_accessdefense_evasionexecutionpersistence

behavioral2

collectioncredential_accessdefense_evasionexecutionpersistence

behavioral3

collectioncredential_accessdefense_evasionexecutionpersistence