spynote | e600a3c55b71d262130bcb33e70bca5ed5d867ed2076ad952fdf4f94e1e37c04 | Triage

Resubmissions

28/03/2025, 10:50

250328-mw75navvfw 10

28/03/2025, 10:48

250328-mwbrfsvvex 10

Sharing

General

Target

Image Logger.apk
Size

6.3MB
Sample

250328-mwbrfsvvex
MD5

823837c2152c1b0418f5b394da9adec7
SHA1

9fcff40616bf982cec57a227fe368bfb59ca868a
SHA256

e600a3c55b71d262130bcb33e70bca5ed5d867ed2076ad952fdf4f94e1e37c04
SHA512

512010775e9dadcac524797194faccd706d5fe3ed4c803b27554f5f8a77943fd55e4f057175d8c355724237970752893e18f1cb2153686cc4fd88fe854165136
SSDEEP

98304:wk9GRSv9xebyOPOc9rMmBopvfzymzhzB7ZT60tFe1i5:w3Sv9IbNFVM4u5zxZEu

Score

10^/10

spynote android banker collection credential_access defense_evasion evasion execution infostealer persistence rat trojan

Malware Config

Targets

- Target
  
  Image Logger.apk
- Size
  
  6.3MB
- MD5
  
  823837c2152c1b0418f5b394da9adec7
- SHA1
  
  9fcff40616bf982cec57a227fe368bfb59ca868a
- SHA256
  
  e600a3c55b71d262130bcb33e70bca5ed5d867ed2076ad952fdf4f94e1e37c04
- SHA512
  
  512010775e9dadcac524797194faccd706d5fe3ed4c803b27554f5f8a77943fd55e4f057175d8c355724237970752893e18f1cb2153686cc4fd88fe854165136
- SSDEEP
  
  98304:wk9GRSv9xebyOPOc9rMmBopvfzymzhzB7ZT60tFe1i5:w3Sv9IbNFVM4u5zxZEu
Score

10^/10

spynote banker collection credential_access defense_evasion evasion execution infostealer persistence rat trojan
- Spynote
  Spynote is a Remote Access Trojan first seen in 2017.
  banker trojan infostealer rat spynote
- Spynote family
  spynote
- Spynote payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

spynotebankercollectioncredential_accessdefense_evasionevasionexecutioninfostealerpersistencerattrojan