Extracted

• • Target

    c2a7d0ae4f95a2e2de81357948afad740f76c7a2fb7f77917316dd5d5f17d9ca.apk

  • Size

    60.0MB

  • MD5

    b0081c7a5101d0a2b6d9ad4df983bb29

  • SHA1

    c2afd70af6cf2f2c185b1a0a5efe9fda6420f21b

  • SHA256

    c2a7d0ae4f95a2e2de81357948afad740f76c7a2fb7f77917316dd5d5f17d9ca

  • SHA512

    fd1b9513c22cee8d5413e520ffc597b230d61c705667f0f649083cc690b479ecbd440f6756f65e794788809d65c0052b7f91308ee44b0a405618307f338b3eea

  • SSDEEP

    1572864:V8OBXNBCV8S11b3UZ/LK117L3GEXUoVlkaVhEv1hWEYqotjXw:V8cBCuS11bElKb7rHUmSaHE9hdl

  Score

  10^/10

  spynotebankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

  • Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote

  • Spynote family

    spynote

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  behavioral1behavioral2