spynote | a1d1ef4aa6192febb467e048fa0968fe06e872ca98ea1951058db5794d3e6021 | Triage

Sharing

General

Target

a1d1ef4aa6192febb467e048fa0968fe06e872ca98ea1951058db5794d3e6021.bin
Size

4.6MB
Sample

250216-1wqr9szqgz
MD5

7e2b70988e9e401fe7f93f6ca39db6fd
SHA1

896f153f468eee269db32236a4971512a736121b
SHA256

a1d1ef4aa6192febb467e048fa0968fe06e872ca98ea1951058db5794d3e6021
SHA512

4585d4abdeaa787fd124abc5410abe28d486237e80f2998b8f62a9452c6dda8e8d6415248b223ac76d9d9fb6c36ebb9313bc2ec5413d0f0079523e42d4743a67
SSDEEP

98304:uoUBWR6SQ8G16vWX0PQkgTLwUf2fraXM5r4LISJJ5ytkmnEGBF:ujSQ313kg3wUfml5riIcytkmNn

Score

10^/10

spynote android banker collection credential_access defense_evasion evasion execution infostealer persistence rat trojan

Malware Config

Targets

- Target
  
  a1d1ef4aa6192febb467e048fa0968fe06e872ca98ea1951058db5794d3e6021.bin
- Size
  
  4.6MB
- MD5
  
  7e2b70988e9e401fe7f93f6ca39db6fd
- SHA1
  
  896f153f468eee269db32236a4971512a736121b
- SHA256
  
  a1d1ef4aa6192febb467e048fa0968fe06e872ca98ea1951058db5794d3e6021
- SHA512
  
  4585d4abdeaa787fd124abc5410abe28d486237e80f2998b8f62a9452c6dda8e8d6415248b223ac76d9d9fb6c36ebb9313bc2ec5413d0f0079523e42d4743a67
- SSDEEP
  
  98304:uoUBWR6SQ8G16vWX0PQkgTLwUf2fraXM5r4LISJJ5ytkmnEGBF:ujSQ313kg3wUfml5riIcytkmNn
Score

10^/10

spynote banker collection credential_access defense_evasion evasion execution infostealer persistence rat trojan
- Spynote
  Spynote is a Remote Access Trojan first seen in 2017.
  banker trojan infostealer rat spynote
- Spynote family
  spynote
- Spynote payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

spynotebankercollectioncredential_accessdefense_evasionevasionexecutioninfostealerpersistencerattrojan

behavioral2

spynotebankercollectioncredential_accessdefense_evasionevasionexecutioninfostealerpersistencerattrojan